CVE-2026-81565
MediumCVSS 6.9Summary
In the SP Page Builder extension (versions 4.0.0 - 6.9.0), the folder request parameter replaced the generated date-based destination folder entirely and was passed to Folder::create() and File::upload() without directory boundary checks. This allowed files to be written into any directory beneath the web root, including administrator/, templates/, cli/ and the site root. Joomla's PATH input filter prevented traversal above the web root, and existing files were not overwritten.
Risk Assessment
An attacker can place malicious files in critical site directories, potentially leading to site takeover or arbitrary code execution. The risk is high as it affects both the free and Pro versions of the extension.
Recommendation
Update SP Page Builder to a version newer than 6.9.0 that contains the fix. Until then, consider restricting access to media upload functionality and monitor site directories for unexpected files.
Other vulnerabilities in SP Page Builder
See all- CVE-2026-81566Medium
The Joomla extension SP Page Builder (Free and Pro) versions 4.0.0–6.9.0 contains a Missing Access Control vulnerability in menu item creation. The add-to-menu routine invoked the com_menus item model's save() method directly; that model does not perform authorisation itself, because the relevant checks reside in the com_menus controller, and the only check applied was core.edit on com_sppagebuilder. Users with no permissions whatsoever on com_menus could therefore create menu items, and because the record identifier was taken from the submitted jform[menuid] field, could also overwrite existing ones. The home flag was read back from the database and preserved, so the site's home menu item could be repointed while remaining the home item.
- CVE-2026-81564High
Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The media rename task applied neither of the directory boundary checks used by the folder operations in the same controller, and its validation guard required only that either a media record exist for the supplied identifier or that the supplied path be present in #__spmedia, rather than both. The identifier and the path were consequently never checked against one another, so any valid media identifier could be paired with an unrelated filesystem path, and the STR input filter left traversal sequences intact. An attacker could rename files elsewhere in the installation, including renaming configuration.php to take the site offline.
- CVE-2026-78375High
Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave() read jform[attribs][sppagebuilder_article_id] from the request and concatenated it directly into the WHERE view_id = ... clause of a query against #__sppagebuilder without quoting or type casting. Joomla's ARRAY input filter does not sanitise element values, as InputFilter::clean() returns (array) $source with the elements untouched, so the entire payload could be delivered in a single POST field. The affected block also executed before the com_content.article context test, so it ran on every onContentAfterSave event regardless of which component triggered the save. An attacker could perform time-based blind SQL injection to read arbitrary database contents, including the #__users and #__session tables.
- CVE-2026-67285Critical
Joomla extension SP Page Builder before version 6.8.0 contains an unauthenticated arbitrary local PHP file inclusion vulnerability. An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.
- CVE-2026-65879Critical
Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1. The hardcoded secret allowed attackers to forge the mail from address of forms.
- CVE-2026-65876Critical
Joomla extension SP Page Builder before version 6.8.0 contains an unauthenticated SQL injection vulnerability. Improper validation of catid parameters in the loadMoreArticles endpoint allows an attacker to execute SQL queries.
- CVE-2026-65766Critical
The SP Page Builder extension for Joomla versions below 6.7.1 contains an unauthenticated SQL injection vulnerability in the Dynamic Content endpoint due to improper validation of the order parameter.
- CVE-2026-48908CriticalActively exploited
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
- CVE-2026-67287Medium
In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create comments even when guest commenting is disabled by overriding the setting with user-supplied input.
- CVE-2026-67286Medium
In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create arbitrary directories and files with a predefined name.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create() and File::upload() without either of the directory boundary checks applied elsewhere in the same file. Files could be written into any directory beneath the web root, including administrator/, templates/, cli/ and the site root. Joomla's PATH input filter prevented traversal above the web root, and existing files were not overwritten.