CVE-2026-48908
Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
- Critical 10.0
- Exploited: added to CISA KEV 7 Jul 2026
Description
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
Key facts
- Published
- 20 Jun 2026
- Last changed
- 8 Oct 2026
- Assigned by
- Joomla
- KEV added
- 7 Jul 2026
- KEV fix due
- 10 Jul 2026
- EPSS
- 89.176% likely to be exploited in the next 30 days, higher than 99.785% of CVEs (scores for 15 Nov 2026)
- SSVC (CISA)
- Exploitation: active; Automatable: yes; Technical impact: total
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 10.0CVSS 4.0, Criticalfrom the CNA (Joomla)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
What to do
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.CISA KEV required action
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
CAPEC-242: Code Injection (CNA impact statement)
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| joomshaper.net | SP Page Builder extension for Joomla |
|
Timeline
- 20 Jun 2026 Published
- 7 Jul 2026 Added to the CISA KEV catalogue