Dashboard / CVE-2026-48908

CVE-2026-48908

CRITICAL CISA KEV
ACT NOW Priority: 8.85 BB Relevance: 90/100
Published: 2026-06-20 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

CISA Known Exploited Vulnerability

Vendor / Product JoomShaper — SP Page Builder
Date Added 2026-07-07
Remediation Due 2026-07-10
https://extensions.joomla.org/extension/sp-page-builder/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48908

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
ollyo sp_page_builder < 6.6.2

References & Advisories (5)

Bug Bounty Relevance

90 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ Known exploited (KEV)
✓ High exploitation probability

CVSS Score

10.0 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red

EPSS — Exploitation Probability

88.51%
Raw Score 0.885120
Percentile 99.8%
Date 2026-10-28

Intelligence Sources

kev ref →
nvd ref →

External Links