CVE-2026-81564 Overview
CVE-2026-81564 is a directory traversal vulnerability in the JoomShaper SP Page Builder extension for Joomla, affecting both Free and Pro editions from version 4.0.0 through 6.9.0. The flaw resides in the media rename task of the extension's controller, which omits the directory boundary checks applied to sibling folder operations. An authenticated attacker with sufficient privileges can rename arbitrary files anywhere in the Joomla installation, including renaming configuration.php to take the site offline. The vulnerability is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.
Critical Impact
An attacker can rename configuration.php or other critical files, causing complete site unavailability and integrity loss across the Joomla installation.
Affected Products
- JoomShaper SP Page Builder Free 4.0.0 through 6.9.0
- JoomShaper SP Page Builder Pro 4.0.0 through 6.9.0
- Joomla installations running the vulnerable extension versions
Discovery Timeline
- 2026-09-14 - CVE-2026-81564 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-81564
Vulnerability Analysis
The vulnerability exists in the media rename task inside the SP Page Builder controller. Folder operations in the same controller enforce directory boundary checks to prevent traversal outside the media root. The media rename task omits these checks entirely. The validation guard requires only that a media record exist for the supplied identifier OR that the supplied path be present in the #__spmedia table, rather than requiring both conditions. This disjunctive check breaks the binding between identifier and path.
An attacker can therefore pair any valid media identifier with an unrelated filesystem path. The STR input filter processes the path parameter but leaves traversal sequences such as ../ intact. The combination of missing boundary enforcement and permissive input filtering permits arbitrary file rename operations across the web root.
Root Cause
The root cause is dual: missing directory confinement logic in the rename handler, and a flawed validation predicate that uses logical OR instead of logical AND when correlating the media identifier with the supplied path. The STR filter does not strip or reject ../ sequences, so traversal payloads survive input processing.
Attack Vector
Exploitation requires an authenticated session with permission to invoke the media rename task. The attacker submits a request containing a legitimate media record identifier alongside a target path that traverses outside the media directory. The controller accepts the request because the identifier passes the OR-based guard, then executes the rename against the attacker-supplied path. Renaming configuration.php removes Joomla's ability to bootstrap, resulting in a denial of service condition. Refer to the JoomShaper SP Page Builder Pro product page for vendor context.
// No verified proof-of-concept code is published for CVE-2026-81564.
// See the vendor advisory for technical details.
Detection Methods for CVE-2026-81564
Indicators of Compromise
- Unexpected rename events on configuration.php or other PHP files outside the /images/ media root.
- HTTP POST requests to the SP Page Builder media rename endpoint containing ../ sequences in path parameters.
- Sudden Joomla site outages correlated with recent authenticated administrator or editor sessions.
- Entries in the #__spmedia table where the stored path does not match the physical file location.
Detection Strategies
- Inspect web server access logs for requests to SP Page Builder controller endpoints containing encoded or literal path traversal characters.
- Monitor filesystem integrity for renames of Joomla core files, especially configuration.php, .htaccess, and files under /administrator/.
- Correlate authenticated Joomla session activity with filesystem modification events occurring outside the media library path.
Monitoring Recommendations
- Enable file integrity monitoring (FIM) on the Joomla document root with alerts on rename operations targeting configuration or bootstrap files.
- Log and alert on all invocations of the SP Page Builder media rename task, capturing the full request body.
- Aggregate Joomla application logs into a central SIEM to correlate authentication events with rename actions.
How to Mitigate CVE-2026-81564
Immediate Actions Required
- Upgrade SP Page Builder (Free and Pro) to a version above 6.9.0 as soon as the vendor publishes a patched release.
- Restrict SP Page Builder administrative and editor permissions to trusted accounts only, and audit existing user roles.
- Back up configuration.php and the full Joomla document root before applying updates, so recovery is possible if a rename attack has already occurred.
Patch Information
JoomShaper has been notified of the vulnerability. Administrators should consult the JoomShaper SP Page Builder Pro product page for the fixed release version and upgrade instructions. Apply the patched release across all Joomla installations running versions 4.0.0 through 6.9.0.
Workarounds
- Temporarily disable the SP Page Builder extension in the Joomla administrator panel if a patch is not yet available.
- Apply web application firewall (WAF) rules that block requests to SP Page Builder controller endpoints containing ../ or URL-encoded traversal sequences in path parameters.
- Restrict filesystem write permissions on configuration.php and other core Joomla files using operating system ACLs where the web server user does not require write access.
# Example: restrict write permission on configuration.php
chmod 444 /var/www/joomla/configuration.php
chown root:www-data /var/www/joomla/configuration.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
