CVE-2026-81564

SP Page Builder (Free and Pro) versions 4.0.0 through 6.9.0 suffer a path traversal flaw (CWE-22) in the media rename task: unlike the folder operations in the same controller, it applied no directory boundary checks, and its validation only required that a media record exist for the supplied identifier OR that the supplied path exist in the #__spmedia table rather than both, so the identifier and the filesystem path were never checked against each other while the STR input filter left traversal sequences intact. An authenticated attacker with high privileges (CVSS 4.0 base score 7.0, AV:N/PR:H) can pair any valid media identifier with an unrelated path and rename arbitrary files elsewhere in the Joomla installation — including renaming configuration.php to take the site offline. Affected deployments are Joomla sites running SP Page Builder 4.0.0–6.9.0 in either the Free or Pro edition. No public proof of concept is known, the CVE is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Upgrade SP Page Builder (Free and Pro) to a release newer than 6.9.0, ideally the latest version available from joomshaper.com. Until patched, restrict access to the SP Page Builder media manager to trusted administrators only, since exploitation requires high privileges. Check the #__spmedia table, server access logs, and the Joomla root directory for evidence of rename operations targeting files outside the media folder — especially a missing or renamed configuration.php.