Detect CVE-2026-48908 - JoomShaper SP Page Builder Unrestricted File Upload in Microsoft Sentinel
Detects exploitation of CVE-2026-48908, an unrestricted file upload vulnerability (CWE-434) in JoomShaper SP Page Builder for Joomla. Attackers can upload files with dangerous types (e.g., PHP webshells) through the page builder interface, leading to remote code execution. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
KQL Detection Query
union
(
AzureDiagnostics
| where Category == "ApplicationGatewayAccessLog"
| where requestUri_s matches regex @"(?i)/components/com_sppagebuilder/.*upload"
| where httpStatus_d in (200, 201, 202)
| extend FileName = extract(@"filename[^;\r\n]*;[\s]*filename[^;\r\n]*=[\s]*([^;\r\n]*)", 1, tostring(requestBody_s))
| extend FileExt = extract(@"\.(php\d?|phtml|phar|asp|aspx|jsp|cgi|pl|py|rb|sh|bash)$", 0, tolower(FileName))
| where isnotempty(FileExt)
| extend AlertDetail = strcat("Dangerous file upload via SP Page Builder: ", FileName)
| project TimeGenerated, requestUri_s, clientIP_s, FileName, FileExt, AlertDetail
),
(
W3CIISLog
| where csUriStem matches regex @"(?i)/components/com_sppagebuilder"
| where csMethod == "POST"
| where scStatus in (200, 201)
| extend SuspiciousExt = extract(@"(?i)\.(php\d?|phtml|phar|asp|aspx|jsp|cgi|pl|py|rb|sh|bash)", 0, csUriQuery)
| where isnotempty(SuspiciousExt)
| project TimeGenerated, cIP, csUriStem, csUriQuery, scStatus, SuspiciousExt
),
(
CommonSecurityLog
| where DeviceVendor == "Imperva" or DeviceVendor == "F5"
| where RequestURL matches regex @"(?i)/components/com_sppagebuilder.*upload"
| where RequestMethod == "POST"
| where AdditionalExtensions matches regex @"(?i)\.(php|phtml|phar|asp|aspx|jsp)"
| project TimeGenerated, SourceIP, RequestURL, RequestMethod, AdditionalExtensions
)
| extend CVE = "CVE-2026-48908"
| extend Tactic = "Initial Access / Execution"
| extend RiskScore = 90Detects HTTP POST requests to SP Page Builder upload endpoints containing dangerous file extensions (PHP, ASP, JSP, etc.) indicating potential webshell upload exploitation of CVE-2026-48908.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate administrative file uploads by Joomla administrators using SP Page Builder for authorized content
- Security scanning tools performing vulnerability assessments against the Joomla installation
- Penetration testing activities against the web application with prior authorization
Other platforms for CVE-2026-48908
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated PHP Webshell Upload via SP Page Builder
Expected signal: Web server access log entry: POST /index.php?option=com_sppagebuilder&task=file.upload HTTP/1.1 200; multipart/form-data body containing filename=shell.php with PHP content
- Test 2Double Extension Bypass Upload Attempt
Expected signal: POST request to SP Page Builder upload endpoint with filename containing double extension (.php.jpg); web server logs showing 200 response and file write event to upload directory
- Test 3Webshell Execution Verification Post-Upload
Expected signal: Web server access log entries: GET /images/shell.php HTTP/1.1 200; process execution events showing php-fpm or apache spawning child processes (id, hostname, uname); potential outbound network connections from web server process
References (4)
- https://extensions.joomla.org/extension/sp-page-builder/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-48908
Unlock Pro Content
Get the full detection package for CVE-2026-48908 including response playbook, investigation guide, and atomic red team tests.