CVE Catalog
CVE-2026-67285
CriticalCVSS 9.2Summary
Joomla extension SP Page Builder before version 6.8.0 contains an unauthenticated arbitrary local PHP file inclusion vulnerability. An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.
Risk Assessment
An attacker can execute arbitrary local PHP files, potentially leading to code execution on the server, disclosure of sensitive data, or takeover of the application.
Recommendation
Update SP Page Builder to version 6.8.0 or later, which includes the fix.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.