Joomla SP Page Builder <= 6.6.1 - Unauthenticated Arbitrary File Upload RCE
CVE-2026-48908
Verified
Description
SP Page Builder for Joomla contains an unrestricted file upload vulnerability allowing unauthenticated users to upload and execute arbitrary PHP code, exploit requires no authentication.
Severity
Critical
CVSS Score
9.8
Exploit Probability
89%
Affected Product
sp_page_builder
Published Date
July 23, 2026
Template Author
0x_akoko
CVE-2026-48908.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-48908
CWE ID:
cwe-284
Remediation Steps
Update to the latest version of SP Page Builder for Joomla.