NC4, (NACSA), has observed multiple attacks and incidents involving CVE-2026-48908, a critical improper access control vulnerability (CWE-284) in the SP Page Builder extension for Joomla.
The vulnerability allows an unauthenticated remote attacker to abuse the custom icon upload function to upload and execute arbitrary PHP code, resulting in pre-authentication remote code execution on the affected web server.
Remote code execution: Successful exploitation grants full arbitrary PHP code execution on the affected web server.
Persistent backdoor: Attackers can drop a web shell, establishing persistent unauthorised access.
Full server compromise: Code execution can lead to data theft, defacement, lateral movement, and complete takeover of the hosting environment.
Confidentiality, integrity, and availability of the affected system and its hosted data are all potentially at risk.
Affected product: SP Page Builder extension for Joomla from joomshaper.net
Affected versions: 1.0.0 to 6.6.1
Recommended version: 6.6.2 or later
Risk level: Critical (CVSS 10.0)
Update SP Page builder to version 6.6.2 without delay on all Joomla installations.
For older deployments that cannot meet the requirements of 6.6.2, or upgrading is not immediately possible, restrict access to the upload functionality so that only authenticated administrators can use it.
Hardening / Mitigation
Restrict web server access to the /tmp/ directory and prevent PHP execution in temporary/upload directories at the web server level.
Optionally deploy a web application firewall rule or intrusion detection system to detect and block suspicious file upload attempts, especially those with PHP extensions.
Restrict upload destinations to directories outside the web root where possible.
Detection / Post-Compromise Forensics
web server access logs for suspicious POST requests to SP Page Builder upload paths (e.g. index.php?option=com_sppagebuilder&task=...).
Look for newly created or recently modified PHP files in Joomla media, upload, and /tmp/ directories.
Inspect upload and temporary directories for unexpected content (web shells).
If compromise is confirmed, isolate the host, preserve evidence, and initiate incident response. Assume credential theft and lateral movement until proven otherwise.
Malaysian NCII entities affected by this advisory are advised to report indicators or incidents to NC4 as per required under Act 854 for National coordination and intelligence sharing.
NVD — CVE-2026-48908
OpenCVE – CVE-2026-48908
CVE-2026-48908-PoC
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
