CVE-2026-65878
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The SP Page Builder extension for Joomla (from joomshaper.com) below version 6.7.1 allows an authenticated user to delete arbitrary files due to improper path validation and ACL checks in the media manager.
Risk Assessment
Risk of losing critical system files or data, potentially leading to site downtime and integrity compromise.
Recommendation
Update SP Page Builder to version 6.7.1 or later, which fixes this vulnerability.
Other vulnerabilities in SP Page Builder
See all- CVE-2026-67285Critical
Joomla extension SP Page Builder before version 6.8.0 contains an unauthenticated arbitrary local PHP file inclusion vulnerability. An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.
- CVE-2026-65879Critical
Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1. The hardcoded secret allowed attackers to forge the mail from address of forms.
- CVE-2026-65876Critical
Joomla extension SP Page Builder before version 6.8.0 contains an unauthenticated SQL injection vulnerability. Improper validation of catid parameters in the loadMoreArticles endpoint allows an attacker to execute SQL queries.
- CVE-2026-65766Critical
The SP Page Builder extension for Joomla versions below 6.7.1 contains an unauthenticated SQL injection vulnerability in the Dynamic Content endpoint due to improper validation of the order parameter.
- CVE-2026-48908CriticalActively exploited
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
- CVE-2026-67287Medium
In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create comments even when guest commenting is disabled by overriding the setting with user-supplied input.
- CVE-2026-67286Medium
In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create arbitrary directories and files with a predefined name.
- CVE-2026-66494High
An unauthenticated stored XSS vulnerability in SP Page Builder (< 6.7.0) for Joomla allows an attacker to store malicious JavaScript in the site's database via a single HTTP request. When an administrator opens the editor, the script executes automatically.
- CVE-2026-65877High
The SP Page Builder extension for Joomla (from joomshaper.com) below version 6.7.1 contains an SQL injection vulnerability in the search and date filters of the media manager, allowing an authenticated user to manipulate database queries.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager.