CVE-2026-48908

This flaw lets a stranger on the internet upload a specially crafted file to your Joomla site without needing an account. That file can be made to run as server-side code (like PHP), which means the attacker may be able to fully control your server, not just your website pages.

This matters if you run Joomla and have the “SP Page Builder extension for Joomla” (sp page builder) installed on versions below 6.6.2. Because it can be exploited without logging in, it’s especially risky for sites that are reachable from the internet. Treat it as an urgent risk if the vulnerable extension is installed and accessible through normal web requests (the key gate here is “version < 6.6.2” with unauthenticated reachability).

This is a RED issue because it is confirmed in CISA’s KEV and can be used for unauthenticated remote code execution via arbitrary file upload. The real-world exploitation status is enough that you should treat it as actively dangerous now, not as a future risk.