CVE-2026-48908: Joomla SP Page Builder Unauthenticated File Upload RCE Under Mass Exploitation, Over 15,000 Attack Attempts in 7 Days

Joomla SP Page Builder has a critical unauthenticated file-upload flaw that lets attackers upload PHP files and execute arbitrary code. FortiGuard data shows more than 15,626 attack attempts in seven days.

On July 7, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48908 to the Known Exploited Vulnerabilities (KEV) catalog. The flaw affects the popular Joomla extension SP Page Builder and lets unauthenticated attackers upload and execute arbitrary PHP code. FortiGuard Labs reports large-scale automated attacks.

Incident Overview

CVE-2026-48908 is a critical vulnerability in the JoomShaper SP Page Builder extension. The extension is a widely used drag-and-drop page builder in the Joomla ecosystem. Users can create complex page layouts without writing code.

The flaw sits in the `asset.uploadCustomIcon` endpoint. That interface lets unauthenticated users upload custom icon font packs (ZIP). Server-side checks on file type and content are insufficient. Attackers can upload a ZIP that contains a malicious PHP file, then overwrite server config with an .htaccess file to achieve code execution.

Technical Details

Attack Path

Per 360 Vulnerability Research Institute analysis, attackers abused a case-sensitive filename filter. The server blocked the `.php` extension but not `.PHP` (uppercase). Attackers can craft a ZIP that contains:

• A malicious `.PHP` file
• An `.htaccess` file that overwrites server config and tells the web server to parse `.PHP` as PHP scripts

This combo bypasses common extension blacklists and default server config. Result: reliable remote code execution.

Impact

• Affected versions: SP Page Builder 1.0.0 – 6.6.1
• Patched version: SP Page Builder 6.6.2 (released June 20, 2026)
• CVSS 4.0: 10.0 Critical
• CVSS 3.1: 9.8 Critical
• Weakness: CWE-434 (Unrestricted Upload of File with Dangerous Type)

Impact Assessment

In-the-Wild Exploitation

FortiGuard Labs data shows ongoing automated scan-and-exploit activity:

• Past 24 hours: 1,210 blocked exploit attempts
• Past 7 days: 15,626 blocked exploit attempts

Highest attack volume came from Poland, Turkey, Australia, and the United States. Telecom/carrier and technology sectors saw the heaviest concentration.

Potential Consequences

After successful exploitation, attackers typically:

• Deploy web shells and backdoors
• Create unauthorized admin accounts
• Steal database credentials and sensitive data
• Use compromised systems as a pivot for further attacks

Remediation

Immediate Patch

Upgrade SP Page Builder to 6.6.2 or later. Note: the patch only stops future attacks. It does not remove existing compromise. Organizations should investigate whether systems are already breached.

Temporary Mitigations

• Restrict public access to the Joomla admin backend
• Disable PHP execution in upload/media directories
• Deploy WAF detection rules for the SP Page Builder upload endpoint

Post-Incident Detection

• Check for unauthorized PHP files on the system
• Review newly created admin accounts
• Inspect web server logs for suspicious POST requests
• Use FortiGuard IPS or similar security devices to detect exploit attempts

References

• FortiGuard Labs outbreak alert
• NVD CVE-2026-48908 details
• CISA KEV catalog
• JoomShaper official advisory
• 360 Vulnerability Research Institute analysis