CRITICAL

CVE-2026-48908

Ollyo Sp Page Builder Published 2026-06-20 CVSS v3.1

View on NVD View on MITRE Check if this affects your version

CVSS Score

9.8

KEV

Description

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

Summary

CVE-2026-48908 is a critical vulnerability in SP Page Builder for Joomla that allows unauthenticated users to upload arbitrary files, which can lead to the execution of malicious PHP code. This poses a significant security risk as it can be exploited to compromise the affected system.

Mitigation

To remediate this vulnerability, it is essential to restrict file uploads and implement proper authentication mechanisms. Additionally, updating to the latest version of SP Page Builder that addresses this issue is recommended.

Weakness Classification (CWE)

CWE-434 Unrestricted File Upload

Exploit Prediction (EPSS)

88.51%

Probability of exploitation activity in the next 30 days

99.8th percentile across all scored CVEs

References

https://www.joomshaper.com/page-builder Product https://extensions.joomla.org/extension/sp-page-builder/ Product https://mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce/ Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908 US Government Resource https://www.joomshaper.com/forum/question/45152 Issue Tracking

Primary Sources

Always verify findings against the primary CVE record before acting. Both sources below are public-domain and authoritative.

NVD — NIST Official CVE enrichment, CVSS, CPE

MITRE CVE Program Official CVE record of authority

Does this affect your version?

Use the CVE Detector to check if a specific product version is impacted by this vulnerability, along with 100+ other CVEs.

Back to CVE Dashboard Search Other CVEs

CVE data aggregated from the National Vulnerability Database (NVD, public domain) and enriched by dbcve.org.