CVE-2026-48908

CVE-2026-48908 is an unrestricted upload of files with dangerous types (CWE-434) in the SP Page Builder extension for Joomla developed by JoomShaper/Ollyo. An unauthenticated remote attacker can submit arbitrary files, including PHP files, to the vulnerable upload functionality, and the web server subsequently executes the uploaded PHP. Successful exploitation therefore results in full remote code execution on the hosting server with the privileges of the web service, giving the attacker control over the Joomla site and its data (CVSS 4.0 base score: 10.0, critical). Any Joomla site running SP Page Builder is affected; the available data does not specify affected or fixed version ranges. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-07, and EPSS assigns a 14.8% probability of exploitation within 30 days (96th percentile); no public proof-of-concept is known.

What to do: Upgrade SP Page Builder to the latest release published by Ollyo/JoomShaper and follow the vendor advisory (no specific fixed version is provided in this data); federal agencies must apply mitigations per CISA's BOD 26-04 timelines and the KEV required action. Until patched, restrict or firewall unauthenticated access to SP Page Builder upload endpoints and review web-access logs and upload directories for recently dropped PHP files or webshells, since the flaw is confirmed exploited in the wild.