Description
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| joomshaper.net | SP Page Builder extension for Joomla | 1.0.0-6.6.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 11 repositories · most starred shown
-
papageo75/CVE-2026-48908-PoC ★ 18 · Jun 22, 2026
Unauthenticated RCE PoC for CVE-2026-48908 — SP Page Builder for Joomla (≤ 6.6.1): arbitrary file upload via asset.uploadCustomIcon. Self-cleaning, token-guarded. Authorized testing only.
-
Jenderal92/CVE-2026-48908 ★ 3 · Jul 7, 2026
CVE-2026-48908 — PoC exploit for unauthenticated RCE in SP Page Builder (Joomla) via arbitrary file upload. Multi‑threaded, case‑bypass, shell verification. For authorized security testing only.
-
yora1928/CVE-2026-48908-by-yora ★ 2 · Aug 12, 2026
Passive security checker for CVE-2026-48908 affecting SP Page Builder.
-
imXur/CVE-2026-48908-Joomla-SP-Page-Builder-RCE ★ 2 · Jul 25, 2026
Technical analysis and advisory for CVE-2026-48908: Unauthenticated Arbitrary File Upload to RCE in JoomShaper SP Page Builder.
-
ashrafzaryouh/CVE-2026-48908 ★ 2 · Jun 24, 2026
CVE-2026-48908
-
winrarzipsexploit/CVE-2026-48908 ★ 0 · Sep 17, 2026
CVE-2026-48908 SP Page Builder (Joomla) unauth RCE suite — authorized testing only
-
g0thamRabb1t/CVE-2026-48908-joomla-sp-page-builder-detection ★ 0 · Jul 9, 2026
Laboratory validation of CVE-2026-48908 in Joomla SP Page Builder, covering unauthorized icon upload, PHP file write, code execution as www-data, auditd and PCAP evidence, event timeline reconstructi…
-
bayu06802/CVE-2026-48908 ★ 0 · Jul 5, 2026
-
ayiezola/CVE-2026-48908 ★ 0 · Jun 28, 2026
Unauthenticated RCE PoC for CVE-2026-48908 SP Page Builder (Joomla) arbitrary file upload and remote code execution exploit with mass scaning support.
-
gagaltotal/CVE-2026-48908-SP-Page-Builder-Joomla ★ 0 · Jun 24, 2026
CVE-2026-48908 - SP Page Builder Joomla Unauthenticated RCE
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Joomla SP Page Builder <= 6.6.1 - Unauthenticated Arbitrary File Upload RCE javascript/cves/2026/CVE-2026-48908.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.