{"id":"joomshaper-page-builder-upload-attacks-jun-2026","category":"patch","status":"closed","title":"JoomShaper SP Page Builder upload flaw CVE-2026-48908 exploited to take over Joomla websites","tldr":"Attackers used SP Page Builder's custom icon upload to run code on Joomla websites without signing in. Version 6.6.2 fixes this flaw. Ask your website maintainer to install the current release and check for planted files and administrator accounts.","summary":"CVE-2026-48908 affects JoomShaper SP Page Builder, an extension used to build Joomla websites. Its custom icon upload feature let someone upload and run PHP code on the hosting server without signing in. Attacks were observed before the fix, with researchers reporting stolen database credentials and unauthorised administrator accounts. JoomShaper confirms version 6.6.2 fixes the flaw. Its release history dates that version to 15 June, while mySites.guru says 14 June. Affected-version descriptions also differ: Joomla's CVE record lists 1.0.0–6.6.1; mySites.guru identifies 4.0.0–6.6.1 and explicitly excludes the 3.x branch. NACSA reported multiple attacks on 30 June, and CISA listed the flaw on 7 July. As of 3 November, the fix remains available and JoomShaper lists 6.10.0 as its current release. Updating does not remove an existing compromise. The sources reviewed do not establish how many sites were compromised or whether attacks have ended.","action":"If your family or business has a Joomla website, ask its maintainer to update SP Page Builder to the current JoomShaper release, listed as 6.10.0; 6.6.2 is the first fix for this flaw. Have the maintainer or hosting company check for malicious files and unauthorised administrator accounts, even after updating.","product":"JoomShaper SP Page Builder for Joomla","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-48908"],"tags":["joomshaper","joomla","sp-page-builder","file-upload","remote-code-execution","actively-exploited"],"affected":["SP Page Builder for Joomla 1.0.0–6.6.1, according to Joomla's CVE record; mySites.guru disputes the lower bound and identifies 4.0.0–6.6.1."],"fixed":["SP Page Builder 6.6.2"],"matches":[],"sources":[{"kind":"advisory","title":"Potential security vulnerability identified in SP Page Builder — staff responses","url":"https://www.joomshaper.com/forum/question/45152","by":"JoomShaper","date":""},{"kind":"advisory","title":"SP Page Builder 6 Pro release notes","url":"https://www.joomshaper.com/release/sp-page-builder-pro-next","by":"JoomShaper","date":"2026-10-07"},{"kind":"research","title":"SP Page Builder security vulnerabilities","url":"https://mysites.guru/vulnerabilities/sppagebuilder/","by":"mySites.guru","date":""},{"kind":"advisory","title":"CVE-2026-48908 — Joomla CVE record and CISA data","url":"https://opencve.alliance.unm.edu/cve/CVE-2026-48908","by":"OpenCVE","date":"2026-06-20"},{"kind":"advisory","title":"Critical Unauthenticated Remote Code Execution in SP Pagebuilder extension for Joomla","url":"https://www.nacsa.gov.my/advisory13.php","by":"NACSA","date":"2026-06-30"},{"kind":"news","title":"CISA Urges Immediate Patching of Exploited ColdFusion, Langflow, Joomla Flaws","url":"https://www.securityweek.com/cisa-urges-immediate-patching-of-exploited-coldfusion-langflow-joomla-flaws/","by":"SecurityWeek","date":"2026-07-08"}],"started":"2026-07-07","closed":"2026-10-07","created":"2026-11-03T22:16:53.718Z","updated":"2026-11-03T22:16:53.718Z","cve_notes":[{"cve":"CVE-2026-48908","name":"Unauthenticated file upload in SP Page Builder","what":"Missing checks in SP Page Builder's custom icon upload let an attacker who has not signed in upload PHP files and run code on the Joomla website's server.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-10-07","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"JoomShaper released 6.10.0, the latest version listed as of 3 November. Version 6.6.2 remains the fix for this CVE; subsequent releases also address separate security flaws.","url":"https://www.joomshaper.com/release/sp-page-builder-pro-next","by":"JoomShaper","patch":null},{"at":"2026-07-08","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"SecurityWeek reported attackers planting hidden administrator accounts and a PHP file manager backdoor on Joomla websites.","url":"https://www.securityweek.com/cisa-urges-immediate-patching-of-exploited-coldfusion-langflow-joomla-flaws/","by":"SecurityWeek","patch":null},{"at":"2026-07-07","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added the flaw to its Known Exploited Vulnerabilities catalogue, with a 10 July remediation deadline for US federal agencies.","url":"https://opencve.alliance.unm.edu/cve/CVE-2026-48908","by":"OpenCVE, reproducing CISA's catalogue data","patch":null},{"at":"2026-06-30","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Malaysia's NACSA reported observing multiple attacks and incidents. It urged updating to 6.6.2 and investigating affected servers for malicious files.","url":"https://www.nacsa.gov.my/advisory13.php","by":"NACSA","patch":null},{"at":"2026-06-20","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Joomla published CVE-2026-48908, rating it critical at CVSS 4.0 10.0 and listing versions 1.0.0–6.6.1 as affected.","url":"https://opencve.alliance.unm.edu/cve/CVE-2026-48908","by":"OpenCVE, reproducing Joomla's CVE record","patch":null},{"at":"2026-06-15","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"JoomShaper's release history dates version 6.6.2 to 15 June; its support staff confirm this version fixes the flaw. mySites.guru instead dates its release to 14 June.","url":"https://www.joomshaper.com/release/sp-page-builder-pro-next","by":"JoomShaper","patch":"patched"},{"at":"2026-06-14","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"mySites.guru dates its vulnerability check to 14 June and reports exploitation before a fix, including theft of database credentials and creation of unauthorised administrator accounts.","url":"https://mysites.guru/vulnerabilities/sppagebuilder/","by":"mySites.guru","patch":null},{"at":"2026-06-13","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"JoomShaper staff say they first received a report that night. The precise date attackers began exploiting the flaw is unknown.","url":"https://www.joomshaper.com/forum/question/45152","by":"JoomShaper","patch":"none"}],"url":"https://hard.fyi/live/joomshaper-page-builder-upload-attacks-jun-2026/","json":"https://hard.fyi/api/live?id=joomshaper-page-builder-upload-attacks-jun-2026"}