JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2026-48908 · Published 20/06/2026 · updated 25/10/2026

JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 07/07/2026. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
sp page builder ollyo	`< 6.6.2`	`6.6.2`

Description

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

References

joomshaper.com/page-builder · Product
extensions.joomla.org/extension/sp-page-builder · Product
mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce · Third Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
joomshaper.com/forum/question/45152 · Issue Tracking
CISA KEV · CVE-2026-48908

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free