CVE-2026-65878: SP Page Builder Path Traversal Flaw

CVE-2026-65878 Overview

CVE-2026-65878 is an authenticated arbitrary file deletion vulnerability in the SP Page Builder extension for Joomla, developed by JoomShaper. The flaw affects SP Page Builder versions prior to 6.7.1 and resides in the extension's media manager component. Improper path validation combined with insufficient Access Control List (ACL) checks allow authenticated users to delete arbitrary files on the underlying server. The issue is classified under CWE-22 (Path Traversal).

Critical Impact
Authenticated attackers can delete arbitrary files outside the media manager's intended scope, enabling site disruption, integrity loss, and destructive tampering with Joomla installations.

Affected Products

JoomShaper SP Page Builder for Joomla (versions prior to 6.7.1)
Joomla sites using the SP Page Builder media manager
Joomla environments where SP Page Builder is installed with authenticated user access

Discovery Timeline

2026-07-27 - CVE-2026-65878 published to the National Vulnerability Database (NVD)
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-65878

Vulnerability Analysis

The vulnerability exists in the media manager component of SP Page Builder. Authenticated users can supply crafted file path parameters that bypass the extension's validation logic. The media manager fails to correctly normalize and confine paths within the designated media directory. As a result, requests referencing paths outside the intended scope reach the file deletion routine unfiltered.

Compounding the path validation weakness, the ACL checks do not adequately restrict which authenticated roles can invoke the delete action. Users with lower privileges can trigger deletion operations that should be limited to administrators. This combination transforms a media management feature into an arbitrary file deletion primitive.

Successful exploitation impacts integrity and availability of the Joomla installation. Attackers can remove configuration files, plugin resources, or other assets required for normal site operation.

Root Cause

The root cause is twofold: improper path validation (CWE-22) allowing traversal outside the media root, and insufficient authorization checks on the delete handler. Neither control alone would be sufficient to prevent exploitation, and both are missing or incorrectly implemented in versions prior to 6.7.1.

Attack Vector

Exploitation requires network access to the Joomla site and an authenticated session with any account permitted to interact with the media manager endpoint. The attacker submits a delete request containing a path expression referencing files outside the intended directory. The server processes the request without enforcing directory boundaries or role restrictions and removes the referenced file.

// Verified proof-of-concept code is not publicly available.
// Refer to the MySites Guru advisory for technical details:
// https://mysites.guru/blog/sp-page-builder-sql-injection-mail-relay-disclosure/

Detection Methods for CVE-2026-65878

Indicators of Compromise

Unexpected file deletions within the Joomla web root, particularly outside /images/ or the configured media directory
HTTP requests to SP Page Builder media manager endpoints containing path traversal sequences such as ../ or URL-encoded equivalents
Authenticated sessions from low-privilege accounts issuing delete actions against media manager routes
Missing plugin, template, or configuration files reported by Joomla integrity checks

Detection Strategies

Enable Joomla web server access logging and inspect requests targeting index.php?option=com_sppagebuilder with task parameters that invoke deletion routines
Deploy web application firewall (WAF) rules that flag path traversal sequences in POST bodies and query strings destined for SP Page Builder endpoints
Correlate authentication events with subsequent file deletion API calls to identify anomalous behavior from non-administrative users

Monitoring Recommendations

Monitor file system change events across the Joomla installation directory using host-based integrity monitoring
Alert on deletion of files in sensitive directories such as /administrator/, /plugins/, and root-level configuration files
Track SP Page Builder version inventory across managed Joomla sites and flag any instance below 6.7.1

How to Mitigate CVE-2026-65878

Immediate Actions Required

Upgrade SP Page Builder to version 6.7.1 or later on all Joomla installations
Audit user accounts with access to the media manager and revoke unnecessary privileges
Review web server and Joomla logs for prior exploitation attempts against SP Page Builder endpoints
Back up the Joomla file system and database before applying updates to enable recovery if deletions occurred

Patch Information

JoomShaper addressed the issue in SP Page Builder version 6.7.1. Administrators should update the extension through the Joomla Extension Manager or by downloading the current release from the JoomShaper Page Builder site. Additional technical context is available in the MySites Guru advisory.

Workarounds

Restrict access to the Joomla administrator area using IP allowlists at the web server or WAF layer until patching is complete
Temporarily disable the SP Page Builder extension on sites where an immediate update cannot be applied
Reduce the number of accounts with editor or higher privileges to minimize the exploitable user base
Deploy WAF signatures that block path traversal patterns in requests to com_sppagebuilder endpoints

bash

# Example: verify installed SP Page Builder version via Joomla CLI
php cli/joomla.php extension:list | grep -i "sp page builder"

# Example: block traversal patterns at the web server (nginx)
location ~* /index\.php {
    if ($args ~* "com_sppagebuilder.*\.\./") {
        return 403;
    }
}