CVE-2026-48908: JoomShaper SP Page Builder Unrestricted File Upload — Active Exploitation Detected

Vulnerability Overview

CVE-2026-48908 is an unrestricted file upload vulnerability (CWE-434) in JoomShaper's SP Page Builder extension for Joomla. The root cause is insufficient validation of uploaded file types within the page builder interface, allowing an authenticated attacker — or potentially an unauthenticated one depending on configuration — to upload arbitrary files, including PHP webshells. Successful exploitation results in remote code execution (RCE) on the underlying web server, giving an adversary full control over the affected Joomla instance and potentially the host system.

Affected Software

The vulnerability affects JoomShaper SP Page Builder for Joomla. The vendor is JoomShaper. Specific patched or unaffected version ranges have not yet been published as of the detection disclosure date (2026-07-07), and no patch date is currently confirmed. Organizations running any version of SP Page Builder should treat their installations as potentially vulnerable until an official fix is released and applied.

Exploitation Status

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. KEV listing indicates that threat actors have moved beyond theoretical abuse — defenders should treat this as a priority remediation and actively hunt for indicators of compromise rather than waiting for patch guidance. File upload flaws that enable webshell delivery are a favored initial access technique and often lead to persistence, lateral movement, and data exfiltration if not caught early.

Detection Coverage

Our detection logic targets the behavioral indicators associated with this attack pattern: suspicious file uploads via the SP Page Builder component, the creation of PHP files in Joomla web-accessible directories, and subsequent web requests that invoke those files. We ship coverage across all major SIEM platforms:

• Microsoft Sentinel (KQL) — correlates web access logs for POST requests to SP Page Builder upload endpoints followed by GET/POST activity against newly created .php files.
• Splunk (SPL) — searches Joomla access and error logs for upload events matching dangerous extensions, with a follow-on pivot to webshell execution patterns.
• Elastic (EQL) — uses event sequence logic to chain the upload event to a file-creation alert and an outbound execution signal.
• IBM QRadar (AQL) — queries flow and log source data for anomalous file-write activity in Joomla component directories.
• Sumo Logic — leverages log search queries targeting SP Page Builder HTTP parameter patterns associated with malicious uploads.
• Chronicle (YARA-L) — rule matches on UDM events capturing both the upload and the resulting web server file execution.
• CrowdStrike (CQL) — endpoint-side detection targeting process spawning from web server worker processes following a file upload, a strong indicator of webshell execution.

All queries are tuned to minimize false positives while ensuring high-fidelity coverage for this specific exploitation chain. Detection logic operates at both the network (HTTP log) and endpoint (file system and process) layers for defence-in-depth visibility.

Recommended Action

Prioritize patching SP Page Builder immediately given the KEV listing. In parallel, hunt retrospectively using our provided queries and review web-accessible upload directories for unexpected PHP files. Consider temporarily disabling the SP Page Builder upload feature if a patch is not yet available.

The full detection page — including all SIEM queries, triage guidance, and atomic test cases — is available at /detections/CVE-2026-48908.