imXur/CVE-2026-48908-Joomla-SP-Page-Builder-RCE

GitHubRepository PoCWriteup

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A technical writeup describing CVE-2026-48908, an unauthenticated arbitrary file upload vulnerability in JoomShaper SP Page Builder. The document provides a vulnerability analysis, metrics, root cause explanation, and mitigation guidance but contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists solely of a README.md file containing a technical vulnerability analysis and mitigation guidance for CVE-2026-48908. No executable code, scripts, commands, or deceptive payloads are present. The content is purely informational and does not exhibit any backdoor or harmful behavior.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
LanguagesMarkdown
Target softwareJoomShaper SP Page Builder
Attack typesRemote Code ExecutionArbitrary File Upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file containing a vulnerability analysis, diagrams, and mitigation advice. It does not include any executable code, proof-of-concept script, or scanner logic. The content is purely descriptive and educational, fitting the definition of a writeup.

README.md:1-129

Requirements

  • Target must be running a vulnerable version of JoomShaper SP Page Builder (1.0.0-6.6.1).README.md:21

Observed behavior

  • Describes an unauthenticated POST request to an upload controller that writes a malicious file to a public web directory, followed by a GET request to execute the uploaded code.README.md:69-75
  • Explains that the upload endpoint lacks authorization checks and relies on permissive extension validation.README.md:83-85
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Report
CVE-2026-48908The artifact is a documentation-only repository describing an unauthenticated file upload vulnerability in JoomShaper SP Page Builder.README.md:1-129
Review boundaries

What the analysis did not establish

  • Only one of two text files in the repository (README.md) was included; the second file (likely a license or similar) was omitted, but its absence does not affect classification as no exploit or scanner code is indicated.
  • The analysis is based solely on the supplied text content; no dynamic execution or verification was performed.
  • One additional file (total 2 files in artifact) was omitted from the text evidence packet; its metadata indicates it is a non-text file (likely an image or binary) and was not analyzed. Its content could not be reviewed.
  • The review is limited to the static content of the provided evidence; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1