CVE-2026-48908

Critical · CVSS 9.8

SP Page Builder for Joomla — Unauthenticated Arbitrary File Upload leading to Remote Code Execution (RCE)

CVSS: 9.8; nvd
EPSS: 0.73%; 50th pct
KEV: No
Class: other; CWE-434, CWE-434

Description

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

Search profile — drives PoC discovery

Symbols uploadcustomiconSP Page Buildercom_sppagebuilderuploadfile_uploadphp_uploadcustomicon

Keywords CVE-2026-48908SP Page BuilderJoomla arbitrary file uploaduploadcustomicon RCESP Page Builder unauthenticated uploadcom_sppagebuilder RCEJoomla SP Page Builder exploitSP Page Builder zero dayJoomShaper file upload vulnerabilityCWE-434 Joomla SP Page Builder

Versions: <UNKNOWN>

Ranked PoCs (9) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

ayiezola/CVE-2026-48908 needs review

recent activity

gh_search

★ 0
g0thamRabb1t/CVE-2026-48908-joomla-sp-page-builder-detection needs review

recent activity

gh_search

★ 0
gagaltotal/CVE-2026-48908-SP-Page-Builder-Joomla needs review

recent activity

gh_search · Go

★ 0
webshellseo8/CVE-2026-48908-POC needs review

recent activity

gh_search

★ 0
papageo75/CVE-2026-48908-PoC needs review

recent activity

gh_search · Python

★ 13
0xBlackash/CVE-2026-48908 needs review

recent activity

gh_search · Python

★ 1
Jenderal92/CVE-2026-48908 needs review

recent activity

gh_search · Python

★ 1
bayu06802/CVE-2026-48908 needs review

recent activity

gh_search · Python

★ 0
cazzysoci/cve-2026-48908 needs review

recent activity

gh_search · Python

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-01T00:00:14.000Z · profiled 2026-07-01T18:30:14.000Z