Detections
Analytics
Joomla! SP Page Builder < 6.6.2 Arbitrary Files Upload
critical Web App Scanning Plugin ID 115292
Synopsis
Joomla! SP Page Builder < 6.6.2 Arbitrary Files UploadDescription
SP Page Builder for Joomla! before 6.6.2 allows unauthenticated attackers to upload arbitrary files via the component's file upload functionality, leading to remote code execution.Solution
Upgrade to Joomla! SP Page Builder version 6.6.2 or later.See Also
Plugin Details
Severity: Critical
ID: 115292
Type: Check Based
Family: Component Vulnerability
Published: 7/13/2026
Updated: 7/13/2026
Scan Template: basic, full, pci, scan
Risk Information
VPR
Risk Factor: Critical
Score: 9.2
Percentile: 99.76
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-48908
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score Source: CVE-2026-48908
CVSS v4
Risk Factor: Critical
Base Score: 10
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score Source: CVE-2026-48908
Vulnerability Information
CPE: cpe:2.3:a:ollyo:sp_page_builder:*:*:*:*:-:joomla\!:*:*
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/12/2026
Vulnerability Publication Date: 6/12/2026
CISA Known Exploited Vulnerability Due Dates: 7/10/2026
Reference Information
CVE: CVE-2026-48908
OWASP: 2010-A4, 2010-A8, 2013-A4, 2013-A7, 2013-A9, 2017-A5, 2017-A9, 2021-A1, 2021-A4, 2021-A6, 2025-A1, 2025-A6
WASC: Improper Input Handling, Insufficient Authorization
CAPEC: 1, 19, 441, 478, 479, 502, 503, 536, 546, 550, 551, 552, 556, 558, 562, 563, 564, 578
DISA STIG: APSC-DV-000460, APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.12.6.1, 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SC-6
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-1.4.2, 4.0.2-12.5.2, 4.0.2-14.2.1