CVE-2026-67286: SP Page Builder Path Traversal Vulnerability

CVE-2026-67286 Overview

CVE-2026-67286 is a path traversal vulnerability [CWE-22] affecting the SP Page Builder extension for Joomla, developed by JoomShaper. Versions prior to 6.8.0 allow an unauthenticated attacker to create arbitrary directories and write files with predefined names on the target server. The flaw is reachable over the network without authentication or user interaction. Successful exploitation lets attackers manipulate the file system of Joomla sites that use the affected extension. SP Page Builder is a widely deployed visual page builder for Joomla, expanding the potential attack surface. Site operators running SP Page Builder should treat this as a priority remediation item.

Critical Impact
Unauthenticated attackers can create arbitrary directories and write files with predefined names on Joomla installations running SP Page Builder before version 6.8.0.

Affected Products

JoomShaper SP Page Builder versions prior to 6.8.0
Joomla installations with SP Page Builder extension enabled
Web servers hosting vulnerable SP Page Builder deployments

Discovery Timeline

2026-08-12 - CVE CVE-2026-67286 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-67286

Vulnerability Analysis

The vulnerability resides in the SP Page Builder extension for Joomla and stems from improper limitation of a pathname to a restricted directory [CWE-22]. An unauthenticated attacker can supply crafted input to an exposed endpoint and cause the extension to create directories and write files outside of the intended paths. Because no authentication is required, the attack surface extends to any internet-facing Joomla site running a vulnerable version of the extension. The affected functionality writes files with predefined names, which constrains payload flexibility but still enables filesystem manipulation. Attackers can leverage this primitive to plant marker files, alter site behavior, or stage follow-on attacks against the underlying Joomla instance.

Root Cause

The root cause is insufficient validation and sanitization of user-controlled path components before they reach filesystem write operations. The extension does not adequately restrict directory creation and file write actions to a whitelisted base path. This lets attackers traverse outside the extension's expected working directories.

Attack Vector

The vulnerability is exploited over the network against a vulnerable Joomla site. No credentials, privileges, or user interaction are required. An attacker sends a crafted HTTP request to the affected SP Page Builder endpoint, triggering arbitrary directory creation and file writes. See the JoomShaper Page Builder Overview for product context.

No verified public exploit code is available at the time of publication. The vulnerability mechanism should be described in prose only — refer to vendor advisories once released for technical details.

Detection Methods for CVE-2026-67286

Indicators of Compromise

Unexpected directories appearing under the Joomla web root or SP Page Builder component paths
New files with predictable or predefined names in unusual locations on the web server
HTTP requests to SP Page Builder endpoints containing traversal sequences such as ../ or encoded variants
Web server processes creating files outside of standard upload or cache directories

Detection Strategies

Review web server access logs for anomalous POST or PUT requests targeting SP Page Builder component URLs
Monitor filesystem changes under the Joomla installation directory for creation events not tied to legitimate administrative activity
Correlate unauthenticated request patterns with newly created files or directories on the host

Monitoring Recommendations

Enable file integrity monitoring (FIM) on the Joomla document root and extension directories
Deploy web application firewall (WAF) rules that flag path traversal patterns targeting Joomla components
Retain and centrally aggregate web server and PHP error logs to support post-incident investigation

How to Mitigate CVE-2026-67286

Immediate Actions Required

Upgrade SP Page Builder to version 6.8.0 or later on all Joomla sites
Audit the Joomla web root for unexpected files or directories that may indicate exploitation
Restrict administrative interfaces and extension endpoints behind network controls where feasible
Verify web server process permissions to limit filesystem write scope

Patch Information

JoomShaper addresses the vulnerability in SP Page Builder version 6.8.0. Administrators should update the extension through the Joomla extension manager or by installing the latest package from the vendor. Consult the JoomShaper Page Builder Overview for the current release.

Workarounds

Disable the SP Page Builder extension until the patched version can be installed
Deploy WAF rules blocking requests containing traversal sequences to SP Page Builder endpoints
Restrict write permissions on the web server user to the minimum directories required for Joomla operation
Place the Joomla admin interface behind IP allowlisting or VPN access where possible

bash

# Example: restrict write permissions on Joomla directories
find /var/www/joomla -type d -exec chmod 755 {} \;
find /var/www/joomla -type f -exec chmod 644 {} \;
# Ensure the web server user cannot write outside expected upload paths
chown -R root:www-data /var/www/joomla
chmod -R g+w /var/www/joomla/images /var/www/joomla/tmp /var/www/joomla/cache