CVE-2026-48908

An attacker without any authentication can upload any file to a server using SP Page Builder (CWE-284: Improper Access Control). The file upload mechanism does not properly verify the requester's identity or the type of uploaded file, allowing a PHP file to be placed on the server. Once uploaded, the PHP file can be executed by the web server, giving the attacker full control over the environment.

An attacker can gain the ability to execute arbitrary code remotely (RCE) on the server, which in practice means complete takeover of the application, server, and potentially other systems in the network (lateral movement).

Apply patches available from the vendor according to the references. As an immediate measure, it is recommended to disable or uninstall the SP Page Builder extension until the patch is deployed. The server should also be reviewed for the presence of unauthorized PHP files uploaded before applying the patch.

SP Page Builder for Joomla — specific versions indicated in vendor references (joomshaper.com).

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.