CVE-2026-48908: SP Page Builder for Joomla unauthenticated arbitrary file upload RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable arbitrary file upload leading to PHP execution, with a CVSS 4.0 score of 10 and confirmed exploitation via CISA KEV.

What it is

SP Page Builder for Joomla permits unauthenticated users to upload arbitrary files, which can lead to upload and execution of PHP code. The flaw is an unrestricted file upload (CWE-434) reachable over the network with no privileges or user interaction, making it a full remote code execution path on exposed Joomla sites.

Impact

An attacker can place and execute arbitrary PHP on the server, yielding remote code execution with the web server's privileges and full loss of confidentiality, integrity and availability of the site and its data.

Attack surface

Reached over the network via the component's file upload functionality; the CVSS 4.0 vector shows PR:N and UI:N, so no authentication or user interaction is required. Any internet-exposed Joomla instance running the affected SP Page Builder component is a candidate target.

Exploitation

CVE-2026-48908 is listed in CISA KEV with a due date of 2026-07-10, indicating known exploitation in the wild; EPSS is 0.15086 (96.6th percentile), and a third-party advisory describes it as a zero-day upload/RCE. No ransomware campaign use is documented.

What to do

• Apply the vendor's patched SP Page Builder release as soon as it is available; treat this as the first action given KEV listing.
• If no patch is available, disable or remove the SP Page Builder component until a fix can be applied, per CISA guidance to discontinue use if mitigations are unavailable.
• Restrict or block access to the component's upload endpoints at the WAF or reverse proxy, and enforce authentication where the component allows it.
• Harden the PHP environment: disable execution in upload/media directories, restrict writable paths, and run the web server with least privilege.
• Audit the Joomla site for unauthorized files and unexpected PHP content in upload directories before restoring normal exposure.

Detection

• Monitor web server and Joomla logs for POST requests to SP Page Builder upload endpoints, especially from unauthenticated sessions.
• Alert on newly created files with .php or other executable extensions in upload, media, or cache directories.
• Hunt for anomalous outbound connections or child processes spawned by the web server user (php-fpm/apache) that indicate webshell execution.
• Review file integrity monitoring for unexpected changes under the Joomla components/com_sp_page_builder and upload paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.