CVE entry · CVE-2026-48908
CVE-2026-48908: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
- Actively exploited: added to CISA’s KEV catalog on July 7, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: July 10, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes JoomShaper SP Page Builder, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (extensions.joomla.org)
- NVD entry (NIST)
- CISA KEV catalog