Vulnerability Details CVE-2026-48908
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.881
EPSS Ranking 99.8%
CVSS Severity
CVSS v3 Score 9.8
Proposed Action
JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
Ransomware Campaign
Unknown
References
- https://www.joomshaper.com/page-builder
- https://extensions.joomla.org/extension/sp-page-builder/
- https://mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908
- https://www.joomshaper.com/forum/question/45152
Products affected by CVE-2026-48908
-
cpe:2.3:a:ollyo:sp_page_builder:4.0.7
-
cpe:2.3:a:ollyo:sp_page_builder:4.0.8
-
cpe:2.3:a:ollyo:sp_page_builder:4.0.9
-
cpe:2.3:a:ollyo:sp_page_builder:5.0.0
-
cpe:2.3:a:ollyo:sp_page_builder:5.0.1
-
cpe:2.3:a:ollyo:sp_page_builder:5.0.10
-
cpe:2.3:a:ollyo:sp_page_builder:5.0.2
-
cpe:2.3:a:ollyo:sp_page_builder:5.0.3
-
cpe:2.3:a:ollyo:sp_page_builder:5.0.4
-
cpe:2.3:a:ollyo:sp_page_builder:5.0.5
-
cpe:2.3:a:ollyo:sp_page_builder:5.0.6
-
cpe:2.3:a:ollyo:sp_page_builder:5.0.7
-
cpe:2.3:a:ollyo:sp_page_builder:5.0.8
-
cpe:2.3:a:ollyo:sp_page_builder:5.0.9
-
cpe:2.3:a:ollyo:sp_page_builder:5.1.0
-
cpe:2.3:a:ollyo:sp_page_builder:5.1.1
-
cpe:2.3:a:ollyo:sp_page_builder:5.1.2
-
cpe:2.3:a:ollyo:sp_page_builder:5.1.3
-
cpe:2.3:a:ollyo:sp_page_builder:5.1.4
-
cpe:2.3:a:ollyo:sp_page_builder:5.1.5
-
cpe:2.3:a:ollyo:sp_page_builder:5.1.6
-
cpe:2.3:a:ollyo:sp_page_builder:5.2.0
-
cpe:2.3:a:ollyo:sp_page_builder:5.2.1
-
cpe:2.3:a:ollyo:sp_page_builder:5.2.2
-
cpe:2.3:a:ollyo:sp_page_builder:5.2.3
-
cpe:2.3:a:ollyo:sp_page_builder:5.2.4
-
cpe:2.3:a:ollyo:sp_page_builder:5.2.5
-
cpe:2.3:a:ollyo:sp_page_builder:5.2.6
-
cpe:2.3:a:ollyo:sp_page_builder:5.2.7
-
cpe:2.3:a:ollyo:sp_page_builder:5.2.8
-
cpe:2.3:a:ollyo:sp_page_builder:5.2.9
-
cpe:2.3:a:ollyo:sp_page_builder:5.3.0
-
cpe:2.3:a:ollyo:sp_page_builder:5.3.1
-
cpe:2.3:a:ollyo:sp_page_builder:5.3.2
-
cpe:2.3:a:ollyo:sp_page_builder:5.3.3
-
cpe:2.3:a:ollyo:sp_page_builder:5.3.4
-
cpe:2.3:a:ollyo:sp_page_builder:5.3.5
-
cpe:2.3:a:ollyo:sp_page_builder:5.4.0
-
cpe:2.3:a:ollyo:sp_page_builder:5.4.1
-
cpe:2.3:a:ollyo:sp_page_builder:5.4.2
-
cpe:2.3:a:ollyo:sp_page_builder:5.4.3
-
cpe:2.3:a:ollyo:sp_page_builder:5.4.4
-
cpe:2.3:a:ollyo:sp_page_builder:5.4.5
-
cpe:2.3:a:ollyo:sp_page_builder:5.4.6
-
cpe:2.3:a:ollyo:sp_page_builder:5.5.0
-
cpe:2.3:a:ollyo:sp_page_builder:5.5.1
-
cpe:2.3:a:ollyo:sp_page_builder:5.5.2
-
cpe:2.3:a:ollyo:sp_page_builder:5.5.3
-
cpe:2.3:a:ollyo:sp_page_builder:5.5.4
-
cpe:2.3:a:ollyo:sp_page_builder:5.5.5
-
cpe:2.3:a:ollyo:sp_page_builder:5.5.6
-
cpe:2.3:a:ollyo:sp_page_builder:5.5.7
-
cpe:2.3:a:ollyo:sp_page_builder:5.6.0
-
cpe:2.3:a:ollyo:sp_page_builder:5.6.1
-
cpe:2.3:a:ollyo:sp_page_builder:5.7.0
-
cpe:2.3:a:ollyo:sp_page_builder:5.7.1
-
cpe:2.3:a:ollyo:sp_page_builder:5.7.2
-
cpe:2.3:a:ollyo:sp_page_builder:6.0.0
-
cpe:2.3:a:ollyo:sp_page_builder:6.1.0
-
cpe:2.3:a:ollyo:sp_page_builder:6.1.1
-
cpe:2.3:a:ollyo:sp_page_builder:6.1.2
-
cpe:2.3:a:ollyo:sp_page_builder:6.2.0
-
cpe:2.3:a:ollyo:sp_page_builder:6.2.1
-
cpe:2.3:a:ollyo:sp_page_builder:6.2.2
-
cpe:2.3:a:ollyo:sp_page_builder:6.2.3
-
cpe:2.3:a:ollyo:sp_page_builder:6.3.0
-
cpe:2.3:a:ollyo:sp_page_builder:6.3.1
-
cpe:2.3:a:ollyo:sp_page_builder:6.3.2
-
cpe:2.3:a:ollyo:sp_page_builder:6.4.0
-
cpe:2.3:a:ollyo:sp_page_builder:6.5.0
-
cpe:2.3:a:ollyo:sp_page_builder:6.6.0
-
cpe:2.3:a:ollyo:sp_page_builder:6.6.1