CVE-2026-65877: Joomla SP Page Builder SQLi Vulnerability

CVE-2026-65877 Overview

CVE-2026-65877 is an authenticated SQL injection vulnerability in the SP Page Builder extension for Joomla, developed by JoomShaper. The flaw affects SP Page Builder versions prior to 6.7.1. It stems from improper validation of parameters in the media manager search and date filter functionality [CWE-89]. An attacker with high-privilege authenticated access can inject arbitrary SQL statements into backend queries. Successful exploitation leads to unauthorized disclosure of database contents, including credentials, session data, and site configuration.

Critical Impact
Authenticated attackers can extract sensitive data from the Joomla database through crafted media manager search and date filter parameters.

Affected Products

JoomShaper SP Page Builder versions prior to 6.7.1
Joomla installations with the vulnerable SP Page Builder extension enabled
Sites exposing the media manager interface to authenticated backend users

Discovery Timeline

2026-07-27 - CVE-2026-65877 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-65877

Vulnerability Analysis

SP Page Builder is a widely deployed page building extension for Joomla content management system (CMS) sites. The vulnerable code paths reside in the media manager, specifically the search and date filter handlers. User-supplied parameters flow into SQL query construction without adequate sanitization or parameterized binding. An authenticated user with backend access can supply crafted values that break out of the intended query context. This allows arbitrary SQL execution against the Joomla database. Attack complexity is low and the vector is network-based, requiring only valid credentials with the appropriate role.

Root Cause

The root cause is a classic SQL injection pattern [CWE-89]. Input parameters used by the media manager search feature and date filter are concatenated directly into SQL statements. The extension does not enforce type coercion, whitelist validation, or prepared statements on these values. Because Joomla's database abstraction supports parameter binding, the vulnerability represents a failure to use available safe APIs rather than a framework limitation.

Attack Vector

Exploitation requires authenticated access with permission to reach the media manager. The attacker submits a malicious payload through the search string or date filter parameter. The backend concatenates the payload into a SELECT query executed against the Joomla #__ prefixed tables. Common outcomes include UNION-based data extraction, boolean-based blind extraction, and error-based disclosure. Attackers can enumerate Joomla users, extract password hashes, and read arbitrary tables reachable by the database user. See the MySites Guru SQL Injection Disclosure for technical details on the affected parameters.

Detection Methods for CVE-2026-65877

Indicators of Compromise

Web server access logs containing SQL metacharacters (', --, UNION, SLEEP() in media manager search or date filter parameters
Unusual outbound requests originating from the Joomla server following media manager access
Unexpected reads against Joomla #__users or #__session tables in database query logs
Backend authentication events followed immediately by high-volume media manager requests

Detection Strategies

Enable Joomla database query logging and alert on queries containing UNION, INFORMATION_SCHEMA, or BENCHMARK invocations originating from SP Page Builder endpoints
Deploy web application firewall (WAF) rules that inspect requests to index.php?option=com_sppagebuilder for SQL injection signatures in search and date parameters
Correlate authenticated backend session activity with anomalous query volume or response size deltas

Monitoring Recommendations

Monitor Joomla administrator account creation and privilege changes, which are common post-exploitation actions
Review media manager access patterns for authenticated users, focusing on repeated requests with varying query strings
Track outbound SMTP or HTTP traffic from the web server that may indicate mail relay abuse chained with this SQLi

How to Mitigate CVE-2026-65877

Immediate Actions Required

Upgrade SP Page Builder to version 6.7.1 or later on all Joomla instances
Audit Joomla user accounts and revoke unnecessary backend privileges to reduce the pool of accounts able to exploit this flaw
Rotate credentials and session tokens if exploitation is suspected, and review database contents for tampering
Inspect web and database logs for prior exploitation attempts against the media manager endpoints

Patch Information

JoomShaper addressed the issue in SP Page Builder 6.7.1. Administrators should apply the update through the Joomla extension manager. Refer to the JoomShaper Page Builder Overview for release information.

Workarounds

Restrict backend access using IP allowlists at the web server or firewall layer until patching is complete
Disable or unpublish the SP Page Builder extension if the patch cannot be applied immediately
Deploy WAF signatures that block SQL injection patterns targeting com_sppagebuilder media manager parameters
Enforce least-privilege on the database account used by Joomla to limit data reachable through injection

bash

# Verify installed SP Page Builder version via Joomla CLI
php cli/joomla.php extension:list | grep -i "sp page builder"

# Restrict backend access with an Apache directive
<Location /administrator>
    Require ip 203.0.113.0/24
</Location>