CVE-2026-67286 in SP Page Builder Extension
Summary
by MITRE • 08/12/2026
Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability exists in the Joomla SP Page Builder extension version 6.8.0 and earlier, where an unauthenticated attacker can exploit a directory traversal flaw to create arbitrary directories and write files with predetermined names. The issue stems from insufficient input validation and access control mechanisms within the extension's file handling functionality. Attackers can leverage this weakness to place malicious files in arbitrary locations on the web server, potentially leading to remote code execution or privilege escalation. The vulnerability affects systems running Joomla 3.x and 4.x versions with the affected SP Page Builder extension installed. This flaw aligns with CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') and represents a critical security risk that enables attackers to manipulate the web application's file system without authentication.
The technical implementation involves exploiting a weakness in parameter validation within the SP Page Builder extension's file management functions. When processing user-supplied input for directory creation or file writing operations, the extension fails to properly sanitize or validate the pathname parameters. This allows an attacker to inject malicious path sequences that bypass normal access controls and create directories or files outside of intended locations. The vulnerability specifically impacts the extension's ability to restrict file system operations to legitimate use cases, enabling attackers to manipulate the web server's file structure through crafted requests. The flaw operates at the application layer and does not require authentication, making it particularly dangerous as it can be exploited by anyone with access to the vulnerable web application.
The operational impact of this vulnerability is severe and multifaceted. An attacker who successfully exploits this weakness could gain persistent access to the target system by placing malicious files in web-accessible directories, potentially leading to complete system compromise. The ability to create arbitrary directories provides attackers with a foothold for further exploitation, while the file writing capability enables them to upload malware, backdoors, or other malicious payloads. The vulnerability also poses risks to data integrity and confidentiality, as attackers could modify existing files or create new ones that alter the application's behavior. This type of vulnerability can also facilitate privilege escalation attacks when combined with other weaknesses in the system architecture. Organizations using affected Joomla installations face potential data breaches, service disruption, and compliance violations that may result in significant financial and reputational damage.
Mitigation strategies for this vulnerability should focus on immediate remediation through patching the affected SP Page Builder extension to version 6.8.0 or later, which contains the necessary security fixes. System administrators should also implement network-level restrictions to limit access to vulnerable endpoints and monitor for suspicious file creation activities in web directories. Additional protective measures include implementing proper input validation at all levels of the application stack, enforcing strict access controls on web server directories, and conducting regular security audits of installed extensions. Organizations should consider implementing web application firewalls to detect and block malicious requests targeting known vulnerability patterns. The ATT&CK framework categorizes this type of vulnerability under T1059 - Command and Scripting Interpreter and T1486 - Data Encrypted for Impact, highlighting the potential for command execution and data compromise. Regular security assessments and vulnerability scanning should be conducted to identify similar weaknesses in other installed components and ensure overall system resilience against similar attacks.