CVE-2026-48908: SP Page Builder for Joomla allows unauthenticated arbitrary file upload via asset.uploadCustomIcon, enabling PHP upload and remote code execution.
CVE-2026-48908 is verified against SP Page Builder (com_sppagebuilder) · Joomla extension affected versions: 1.0.0 through 6.6.1 fixed version: 6.6.2 vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00269.
pruva-verify REPRO-2026-00269 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00269/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh SP Page Builder (com_sppagebuilder) for Joomla exposes the asset.uploadCustomIcon task without authentication or CSRF checks, allowing unauthenticated attackers to upload a ZIP archive that is extracted under the web root. By including PHP (or by bypassing extension filters), attackers can achieve remote code execution.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.