CVE-2026-81564 in SP Page Builder Extension
Summary
by MITRE • 09/14/2026
Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The media rename task applied neither of the directory boundary checks used by the folder operations in the same controller, and its validation guard required only that either a media record exist for the supplied identifier or that the supplied path be present in #__spmedia, rather than both. The identifier and the path were consequently never checked against one another, so any valid media identifier could be paired with an unrelated filesystem path, and the STR input filter left traversal sequences intact. An attacker could rename files elsewhere in the installation, including renaming configuration.php to take the site offline.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified involves a critical lack of directory confinement within the SP Page Builder extension for Joomla, specifically affecting versions 4.0.0 through 6.9.0. This flaw resides in the media rename functionality, which fails to enforce proper access controls when manipulating files on the server filesystem. The core technical issue stems from an inconsistent implementation of security checks compared to other operations within the same controller module. While folder operations correctly apply directory boundary checks to ensure that file manipulations remain confined to authorized directories, the media rename task bypasses these essential safeguards entirely. This inconsistency creates a significant attack surface where authenticated users can exploit the logic gap to perform unauthorized filesystem modifications.
The technical mechanism of exploitation relies on a flawed validation guard within the application code. The system requires only one of two conditions to be met for a rename operation to proceed: either a media record must exist for the supplied identifier, or the supplied path must be present in the #__spmedia database table. Crucially, these two inputs are not cross-validated against each other. This allows an attacker to pair a valid media identifier with an arbitrary filesystem path that is unrelated to the original file location. Furthermore, the input filter used for processing this data does not strip directory traversal sequences such as dot-dot-slash. Consequently, the application accepts paths containing these sequences without sanitization, enabling the manipulation of files outside the intended web root or protected directories.
The operational impact of this vulnerability is severe due to its potential for arbitrary file rename operations. An attacker with access to the Joomla administration panel can leverage this flaw to move critical system files from their expected locations. A particularly dangerous scenario involves renaming configuration.php, which contains sensitive database credentials and site settings. By moving or hiding this file, an attacker can effectively take the website offline by preventing legitimate users and processes from accessing necessary configurations. Beyond service disruption, such manipulation could facilitate further attacks, including privilege escalation if combined with other vulnerabilities, or data exfiltration if critical files are moved to publicly accessible directories where they might be downloaded by unauthorized parties.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as the application fails to restrict file operations to specific allowed locations. It also relates to CWE-732: Incorrect Permission Assignment for Critical Resource, given that the misconfiguration allows actions on sensitive files without adequate restriction. In terms of offensive security frameworks, this exploit maps to ATT&CK technique T1083: File and Directory Discovery, as it enables an attacker to locate and manipulate specific system files, potentially leading to T1496: Host-Based Resource Hijacking if the renamed file causes resource exhaustion or service failure.
Mitigation strategies should prioritize immediate patching of the SP Page Builder extension to a version that resolves this logic flaw. Administrators must ensure that all components are updated to versions where the media rename task enforces strict directory confinement and validates that input paths correspond correctly to their associated identifiers. Additionally, implementing web application firewall rules can help detect attempts involving directory traversal sequences in file manipulation requests. Regular audits of file permissions and monitoring for unexpected changes to critical files like configuration.php provide an additional layer of defense against exploitation of this type of vulnerability.