NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

JoomShaper SP Page Builder upload flaw CVE-2026-48908 exploited to take over Joomla websites

Attackers used SP Page Builder's custom icon upload to run code on Joomla websites without signing in. Version 6.6.2 fixes this flaw. Ask your website maintainer to install the current release and check for planted files and administrator accounts.

What to do

If your family or business has a Joomla website, ask its maintainer to update SP Page Builder to the current JoomShaper release, listed as 6.10.0; 6.6.2 is the first fix for this flaw. Have the maintainer or hosting company check for malicious files and unauthorised administrator accounts, even after updating.

What’s happening

CVE-2026-48908 affects JoomShaper SP Page Builder, an extension used to build Joomla websites. Its custom icon upload feature let someone upload and run PHP code on the hosting server without signing in. Attacks were observed before the fix, with researchers reporting stolen database credentials and unauthorised administrator accounts. JoomShaper confirms version 6.6.2 fixes the flaw. Its release history dates that version to 15 June, while mySites.guru says 14 June. Affected-version descriptions also differ: Joomla's CVE record lists 1.0.0–6.6.1; mySites.guru identifies 4.0.0–6.6.1 and explicitly excludes the 3.x branch. NACSA reported multiple attacks on 30 June, and CISA listed the flaw on 7 July. As of 3 November, the fix remains available and JoomShaper lists 6.10.0 as its current release. Updating does not remove an existing compromise. The sources reviewed do not establish how many sites were compromised or whether attacks have ended.

What
Flaw
Affects
JoomShaper SP Page Builder for Joomla
Affected
SP Page Builder for Joomla 1.0.0–6.6.1, according to Joomla's CVE record; mySites.guru disputes the lower bound and identifies 4.0.0–6.6.1.
Fixed in
SP Page Builder 6.6.2
CVE
CVE-2026-48908
Since
7 July 2026
Closed
7 Oct 2026

Timeline

  1. Update

    JoomShaper released 6.10.0, the latest version listed as of 3 November. Version 6.6.2 remains the fix for this CVE; subsequent releases also address separate security flaws.

  2. Update

    SecurityWeek reported attackers planting hidden administrator accounts and a PHP file manager backdoor on Joomla websites.

  3. CISA added

    CISA added the flaw to its Known Exploited Vulnerabilities catalogue, with a 10 July remediation deadline for US federal agencies.

  4. Wider attacks

    Malaysia's NACSA reported observing multiple attacks and incidents. It urged updating to 6.6.2 and investigating affected servers for malicious files.

  5. Made public

    Joomla published CVE-2026-48908, rating it critical at CVSS 4.0 10.0 and listing versions 1.0.0–6.6.1 as affected.

  6. New fixFixed

    JoomShaper's release history dates version 6.6.2 to 15 June; its support staff confirm this version fixes the flaw. mySites.guru instead dates its release to 14 June.

  7. Made public

    mySites.guru dates its vulnerability check to 14 June and reports exploitation before a fix, including theft of database credentials and creation of unauthorised administrator accounts.

  8. UpdateNo fix yet

    JoomShaper staff say they first received a report that night. The precise date attackers began exploiting the flaw is unknown.

Sources

  1. Potential security vulnerability identified in SP Page Builder — staff responsesJoomShaper
  2. SP Page Builder 6 Pro release notesJoomShaper · 7 Oct 2026
  3. SP Page Builder security vulnerabilitiesmySites.guru
  4. CVE-2026-48908 — Joomla CVE record and CISA dataOpenCVE · 20 June 2026
  5. Critical Unauthenticated Remote Code Execution in SP Pagebuilder extension for JoomlaNACSA · 30 June 2026
  6. CISA Urges Immediate Patching of Exploited ColdFusion, Langflow, Joomla FlawsSecurityWeek · 8 July 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from July 2026 · JSON · RSS