Critical · published June 20, 2026
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.
🚨 Unauthenticated users can upload any files they want through SP Page Builder in Joomla, opening the door to some seriously nasty PHP execution! 🔥 Consider this vulnerability like a restaurant with an open kitchen — anyone can walk in and whip up their own dish without the chef checking ingredients. This means attackers can upload harmful files and run them without any oversight. If an attacker exploits this flaw, they could upload malicious PHP files that let them take control of your server, steal sensitive data, or even bring your site down entirely. It's absolutely devastating for any Joomla site, leading to potential data breaches and a complete loss of trust from users.
Consider this vulnerability like a restaurant with an open kitchen — anyone can walk in and whip up their own dish without the chef checking ingredients. This means attackers can upload harmful files and run them without any oversight. This vulnerability allows unauthenticated users to bypass file upload restrictions within SP Page Builder, enabling them to upload and execute arbitrary PHP code on the server.
If an attacker exploits this flaw, they could upload malicious PHP files that let them take control of your server, steal sensitive data, or even bring your site down entirely. It's absolutely devastating for any Joomla site, leading to potential data breaches and a complete loss of trust from users. To protect your site, immediately update SP Page Builder to the latest version. Additionally, implement strict file upload validation and sanitize any uploaded files. Don't skip these steps — the risk is too high! You can tackle this! Follow these steps to secure your Joomla site and keep those cyber villains at bay. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ollyo/sp_page_builder | < 6.6.2 | 6.6.2 |