CVE-2026-48908: JoomShaper SP Page Builder Unrestricted Upload of File with

JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability. JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

• CISA KEV-listed (remediation due 2026-07-10)
• EPSS 88.1% (99.8% percentile)
• CVSS 10 critical

Related briefings

• Fake exploit code is stealing security researchers' secrets 2026-08-04
• CISA flags four critical Joomla add-on bugs as exploited 2026-08-02
• CISA warns hackers are exploiting an Adobe ColdFusion flaw 2026-07-07

Browse the CVE database

Read the full analysis on IntelFusions