CVE-2026-48908

This is an arbitrary file upload flaw in the SP Page Builder extension for Joomla. The extension exposes upload functionality to unauthenticated users without properly restricting file type, so an attacker uploads a PHP file and then requests it, causing the web server to execute the attacker's code. That takes it beyond a simple file drop: unauthenticated upload plus execution of PHP is remote code execution on the site, running with the privileges of the web server.

SP Page Builder is a widely used page-building extension, so the vulnerable code sits on public-facing Joomla websites, exactly the kind of broadly deployed CMS plugin that attackers scan for at scale to plant web shells, deface sites, or use the server for further campaigns. An unauthenticated upload-to-RCE in a popular extension tends to be commoditized quickly. Update SP Page Builder to the patched version as soon as it is available, and because exposed sites may already have been hit, inspect upload directories and the webroot for unexpected PHP files and web shells, review web server logs for suspicious POST requests, and rotate credentials stored on or reachable from the host.