Unauthenticated File Upload Flaws in Joomla Builders Lead to Active RCE
Active Exploitation · 4 sources · Updated 4mo ago · First seen Jul 8, 2026
CISA has added two Joomla extension vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation against SP Page Builder and Page Builder CK. The flaws, tracked as CVE-2026-48908 and CVE-2026-56290, are unauthenticated arbitrary file upload bugs that allow attackers to place malicious files on exposed Joomla sites and achieve remote code execution.
Security reporting says the vulnerabilities have been used to upload web shells, deploy PHP file-manager backdoors, and create hidden administrator accounts for persistence on compromised systems. Vendor fixes are available, including SP Page Builder 6.6.2 for the zero-day issue, and defenders are being urged to patch immediately or temporarily disable the affected extensions and restrict public access to vulnerable upload endpoints until remediation is complete.
