CVE-2026-67285: SP Page Builder Path Traversal Vulnerability

CVE-2026-67285 Overview

CVE-2026-67285 is an unauthenticated local file inclusion (LFI) vulnerability in the SP Page Builder extension by JoomShaper for Joomla. Versions prior to 6.8.0 allow remote attackers to include arbitrary PHP files accessible to the web server without authentication. The flaw is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

SP Page Builder is a widely deployed drag-and-drop page building extension for Joomla content management sites. Successful exploitation can lead to disclosure of sensitive files, execution of attacker-controlled PHP payloads staged on the target, and full site compromise.

Critical Impact
Unauthenticated remote attackers can include and execute arbitrary local PHP files, resulting in code execution and full compromise of affected Joomla sites.

Affected Products

JoomShaper SP Page Builder for Joomla, all versions prior to 6.8.0
Joomla installations with SP Page Builder enabled
See the JoomShaper Page Builder Overview for product details

Discovery Timeline

2026-08-12 - CVE-2026-67285 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-67285

Vulnerability Analysis

The vulnerability is a path traversal weakness leading to local file inclusion in SP Page Builder. An unauthenticated attacker sends a crafted HTTP request to an exposed endpoint that accepts a file path or module identifier as input. The extension resolves that input into a PHP include or require call without sufficient normalization or allow-list validation.

Because the include target is a PHP file executed by the Joomla runtime, any local PHP file reachable by the web server user is executed in the site's context. Attackers can chain this with common file staging techniques such as log poisoning, session file writes, or uploaded media that contain PHP payloads. The result is arbitrary code execution as the web server user.

The issue impacts confidentiality, integrity, and availability, and requires no user interaction. Attack complexity is low, though exploitation depends on the presence of an includable PHP file with attacker-influenced content.

Root Cause

The root cause is improper sanitization of a user-controlled path parameter passed to a PHP file inclusion function. The extension fails to canonicalize the input, strip directory traversal sequences such as ../, and restrict inclusion to an approved directory or allow-list of modules.

Attack Vector

The vulnerability is exploitable over the network against any Joomla site running SP Page Builder before 6.8.0. The attacker issues an HTTP request to the vulnerable component endpoint, supplying a manipulated path parameter that resolves to a target PHP file on disk. No credentials, tokens, or user interaction are required.

Typical exploitation chains pair the LFI primitive with a second vector that plants attacker-controlled PHP content on the file system. Common staging vectors include write access to log files parsed as PHP, PHP session files written by the application, or uploaded assets stored under the web root. Refer to the JoomShaper Page Builder Overview for product context; no public proof-of-concept has been referenced in the advisory data.

Detection Methods for CVE-2026-67285

Indicators of Compromise

HTTP requests to SP Page Builder endpoints containing traversal sequences such as ../, ..%2f, or absolute paths in query parameters or POST bodies
Unexpected PHP files or webshells appearing under Joomla images/, tmp/, or media/ directories
Web server error logs referencing include() or require() failures with attacker-supplied paths
New administrator accounts, modified configuration.php, or unexpected scheduled tasks in Joomla

Detection Strategies

Inventory Joomla sites and identify SP Page Builder installations running versions below 6.8.0
Deploy web application firewall rules that block path traversal sequences and null-byte injection in requests targeting SP Page Builder routes
Hunt through historical access logs for suspicious requests to SP Page Builder addon or module handlers with path-like parameters
Correlate LFI request patterns with subsequent PHP process activity spawned by the web server user

Monitoring Recommendations

Enable verbose logging on the Joomla web tier and forward logs to a centralized analytics platform for retention and search
Alert on file integrity changes within the Joomla webroot, particularly new or modified .php files
Monitor outbound network connections initiated by the web server process to detect post-exploitation callbacks
Track authentication events and administrator role changes in Joomla for signs of persistence

How to Mitigate CVE-2026-67285

Immediate Actions Required

Upgrade SP Page Builder to version 6.8.0 or later on all Joomla sites
Audit the Joomla webroot for unauthorized PHP files, modified templates, and rogue administrator accounts
Rotate Joomla administrator credentials, API tokens, and database passwords if compromise is suspected
Restrict access to Joomla administrative endpoints by source IP where feasible

Patch Information

JoomShaper addresses the vulnerability in SP Page Builder 6.8.0. Administrators should apply the vendor update through the Joomla Extension Manager or by installing the updated package from the JoomShaper Page Builder product page. Verify the installed version after upgrade and confirm the extension is fully re-enabled.

Workarounds

If immediate patching is not possible, disable the SP Page Builder extension in the Joomla Extension Manager until the update is applied
Deploy web application firewall signatures that block traversal patterns targeting SP Page Builder request paths
Set the PHP open_basedir directive to restrict file inclusion to the Joomla installation directory
Ensure allow_url_include is disabled and enforce least-privilege file system permissions for the web server user

bash

# Example php.ini hardening to reduce inclusion scope
open_basedir = "/var/www/joomla/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"