CVE-2026-81565: SP Page Builder Path Traversal Vulnerability

CVE-2026-81565 Overview

CVE-2026-81565 is a directory confinement flaw in JoomShaper's SP Page Builder extension (Free and Pro) for Joomla, affecting versions 4.0.0 through 6.9.0. The vulnerability resides in the media upload handler, where the folder request parameter replaces the generated date-based destination path without directory boundary validation. Authenticated users with upload privileges can write files into any directory beneath the Joomla web root, including administrator/, templates/, cli/, and the site root. Joomla's PATH input filter blocks traversal above the web root, and pre-existing files are not overwritten, which limits the blast radius but does not eliminate risk.

Critical Impact
Authenticated attackers can place arbitrary files into sensitive Joomla directories, enabling persistence, template tampering, or staging of follow-on attacks against administrator interfaces.

Affected Products

JoomShaper SP Page Builder Free 4.0.0 through 6.9.0
JoomShaper SP Page Builder Pro 4.0.0 through 6.9.0
Joomla installations running the affected extension versions

Discovery Timeline

2026-09-14 - CVE-2026-81565 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-81565

Vulnerability Analysis

The flaw is categorized under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. SP Page Builder generates a date-based destination folder for media uploads, but the handler accepts a client-supplied folder parameter that overrides this destination outright. The overriding value flows into Folder::create() and File::upload() without the directory boundary checks applied elsewhere in the same file.

The consequence is a confused deputy: the upload endpoint respects authenticated context but ignores the confinement policy enforced on adjacent code paths. Attackers can drop PHP, JavaScript, template overrides, or configuration fragments into directories that Joomla treats as trusted, including administrator/ and templates/. While Joomla's PATH filter prevents escaping above the web root and existing files cannot be clobbered, novel file placement remains possible.

Root Cause

The root cause is missing input validation on the folder parameter before it is used to construct filesystem paths. The developers implemented boundary checks in sibling upload code paths but omitted them from this handler, producing an inconsistent enforcement surface within the same source file.

Attack Vector

Exploitation requires an authenticated Joomla account with high privileges sufficient to reach the SP Page Builder media upload endpoint. The attacker submits an upload request with a crafted folder parameter pointing at a target directory beneath the web root. The extension writes the uploaded file to that location. No user interaction is required beyond the attacker's own session. The primary integrity impact is arbitrary file placement in security-sensitive directories.

Because exploitation depends on a valid authenticated session and file overwrites are blocked, the practical attack scenarios include planting new PHP payloads in writable locations, seeding template files consumed by administrator views, or staging content used later in privilege escalation chains.

Detection Methods for CVE-2026-81565

Indicators of Compromise

Unexpected files appearing in administrator/, templates/, cli/, or the Joomla site root with modification times aligned to SP Page Builder upload activity
HTTP POST requests to SP Page Builder media upload endpoints containing a non-default folder parameter value that references sensitive directories
New .php, .phtml, or template files owned by the web server user in directories that normally host only vendor-supplied content

Detection Strategies

Review Joomla access logs for requests to SP Page Builder upload handlers where the folder parameter deviates from the expected date-based media path
Correlate authenticated administrator or editor sessions with filesystem create events in non-media directories
Run integrity comparisons against a known-good copy of the Joomla install to identify unauthorized files added under administrator/ and templates/

Monitoring Recommendations

Enable filesystem auditing on the Joomla document root to record write events outside images/ and other approved media directories
Alert on web server processes writing files with executable extensions into directories that should be read-only at runtime
Track SP Page Builder version strings across Joomla estates to identify hosts still running 4.0.0 through 6.9.0

How to Mitigate CVE-2026-81565

Immediate Actions Required

Upgrade SP Page Builder (Free or Pro) to a version above 6.9.0 that includes the directory confinement fix from JoomShaper
Audit accounts with upload privileges and revoke access from users who do not require it
Inspect administrator/, templates/, cli/, and the site root for files created since the extension was installed and remove unauthorized content

Patch Information

JoomShaper distributes the corrected extension through its product channel. Refer to the JoomShaper SP Page Builder Pro product page for the current release and download the update through the Joomla extension manager. Apply the update to both Free and Pro editions and verify the installed version after upgrade.

Workarounds

Restrict access to SP Page Builder media upload endpoints at the web server or WAF layer until the patched extension is deployed
Enforce filesystem permissions that make administrator/, templates/, and cli/ non-writable by the web server user where the deployment model allows it
Disable the SP Page Builder extension on production Joomla sites that do not require it until an upgrade is completed

bash

# Example: block writes to sensitive Joomla directories at the OS level
chown -R root:www-data /var/www/joomla/administrator
chown -R root:www-data /var/www/joomla/templates
chown -R root:www-data /var/www/joomla/cli
find /var/www/joomla/administrator -type d -exec chmod 555 {} \;
find /var/www/joomla/templates -type d -exec chmod 555 {} \;
find /var/www/joomla/cli -type d -exec chmod 555 {} \;