Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-48908 9.8
JoomShaper · SP Page Builder · Added 2026-07-07 · Published 2026-06-20
3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityJoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
VendorJoomShaper
ProductSP Page Builder
Date added2026-07-07
Due date2026-07-10
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-434
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions

KEV: JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

NVD: A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required

Research metadata

Last researched2026-08-26 00:41 UTC
Searches2
Component defaultno
Sources https://github.com/Jenderal92/CVE-2026-48908
https://github.com/papageo75/CVE-2026-48908-PoC
https://github.com/ayiezola/CVE-2026-48908
https://nvd.nist.gov/vuln/detail/CVE-2026-48908
https://mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce/
https://www.sentinelone.com/vulnerability-database/cve-2026-48908/
https://www.ionix.io/threat-center/cve-2026-48908/

Hunting hypothesis agent

Hunt access logs for unauthenticated POSTs to com_sppagebuilder task=asset.uploadCustomIcon followed by PHP under /media/com_sppagebuilder/assets/iconfont/; stock logs miss multipart fields so monitor for .php and .PHP files there.

Research details

Componentcom_sppagebuilder asset.uploadCustomIcon controller task
PreconditionsNetwork access to a Joomla site running SP Page Builder versions 1.0.0 through 6.6.1; the com_sppagebuilder component must be installed. No authentication or CSRF token required. The attacker sends a multipart POST with a ZIP archive to index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon, which extracts contents to /media/com_sppagebuilder/assets/iconfont/<name>/. agent
DeliveryUnauthenticated multipart POST to index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon with a ZIP archive (multipart field custom_icon) containing a PHP webshell at fonts/shxt.PHP alongside valid selection.json, style.css, and a dummy .ttf. The ZIP is extracted to /media/com_sppagebuilder/assets/iconfont/<random_name>/ and the shell is accessed via HTTP GET.
Public PoCyes
PoC URLs https://github.com/Jenderal92/CVE-2026-48908
https://github.com/papageo75/CVE-2026-48908-PoC
https://github.com/ayiezola/CVE-2026-48908 Third-party repos; verify before use.
Advisoryhttps://mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce/
Exploit notesPublic PoC available (multi-threaded, Python 2.7) — significantly lowers barrier to exploitation | CVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | The ZIP filter blocks lowercase .php/.phtml/.phar but not mixed-case .PHP; exploit packages a valid icon-font structure (selection.json, style.css, fonts/*.ttf) so the upload is accepted.
SummaryJoomShaper SP Page Builder exposes the asset.uploadCustomIcon task to handle custom icon-font package uploads without requiring authentication or a CSRF token. The controller accepts a ZIP archive via multipart POST and extracts its contents into /media/com_sppagebuilder/assets/iconfont/<name>/, a publicly accessible web directory. The filename filter blocks lowercase PHP extensions but does not normalize case, so .PHP and other mixed-case variants pass through. A valid icon-font structure (selection.json, style.css, fonts/) is packaged alongside the PHP shell to satisfy format checks. Patched in SP Page Builder 6.6.2.

Tia coverage

First reported2026-07-02
First exploit report2026-07-09
Exploit report → KEV2 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

chocopoc-malware-targets-security-researchers-via-trojanized-poccisa-kev-two-new-joomla-extension-entries-added-july-10-icagenda

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub