Vulnerability intelligence
CVE-2026-48908
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
CVSS Score
10
Critical
EPSS — Exploit Probability
88%
Riskier than 100% of all CVEs
Exploitation
Confirmed in the wild
KEV since 2026-07-07
Remediation
Patch available
Federal deadline 2026-07-10
10 articles across 5 outlets · first covered Jul 7, 2026 · latest Jul 9, 2026
Coverage timeline
-
LineageOS Browser Flash Tool Makes ROM Install Easiersecurityonline.info · Jul 9, 2026
-
Network UPS Tools RCE Flaw Affects upsmon, With No Patch Yetsecurityonline.info · Jul 8, 2026
-
Foxit PDF Reader flaws expose users to arbitrary code executionsecurityonline.info · Jul 8, 2026
-
CISA alerts on critical ColdFusion Langflow and Joomla flawswww.securityweek.com · Jul 8, 2026
-
Android Remote Root Exploit Chain Unveiled by Nebulasecurityonline.info · Jul 8, 2026
-
CISA warns of active exploits in ColdFusion, Joomla page builderssecurityaffairs.com · Jul 8, 2026
-
Four flaws hit Joomla, Langflow, ColdFusion and Linux todaysecurityonline.info · Jul 8, 2026
-
CISA flags critical Joomla, ColdFusion bugs under attacksecurityonline.info · Jul 8, 2026
-
CISA flags JoomShaper SP Page Builder upload flaw CVE-2026-48908www.cisa.gov · Jul 7, 2026
-
CISA Adds Critical Joomla SP Page Builder Flaw to KEV Cataloguecisa.gov · Jul 7, 2026