gagaltotal/CVE-2026-48908-SP-Page-Builder-Joomla

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Go-based exploit for CVE-2026-48908 that uploads a malicious ZIP file containing a PHP webshell to a vulnerable Joomla SP Page Builder endpoint, then executes arbitrary commands on the target server.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Go source file (poc_tot.go) that implement a proof-of-concept exploit for CVE-2026-48908. The code uploads a PHP webshell via a ZIP extraction vulnerability in SP Page Builder for Joomla, then executes attacker-supplied commands. All behavior is consistent with the stated exploit purpose; no concealed backdoor, unrelated payload, or operator-directed harm beyond the exploit itself was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesGo
Target softwareJoomla SP Page Builder (com_sppagebuilder)
Attack typesRemote Code ExecutionArbitrary File Upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits the vulnerability by uploading a malicious ZIP file containing a PHP webshell and then executing arbitrary commands on the target. It is not limited to detection or validation; it achieves remote code execution.

poc_tot.go:147-150poc_tot.go:304-309poc_tot.go:628

Requirements

  • Target running Joomla with SP Page Builder component version <= 6.6.1README.md:13
  • Network access to the target Joomla installationREADME.md:27

Observed behavior

  • Crafts a ZIP archive containing a PHP webshell and supporting icon font filespoc_tot.go:146-204
  • Uploads the crafted ZIP to the unauthenticated endpoint index.php?option=com_sppagebuilder&task=asset.uploadCustomIconpoc_tot.go:216-293
  • Executes arbitrary system commands via HTTP GET requests to the extracted PHP webshellpoc_tot.go:304-336
  • Provides an interactive pseudo-shell for continuous command executionpoc_tot.go:467-503
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Uploads a PHP webshell to a Joomla SP Page Builder target and executes commands via HTTP GET parameters 't' (token) and 'c' (command).This is the core exploit functionality described in the README and CVE context. It is not a backdoor against the PoC user.poc_tot.go:146-150poc_tot.go:304-336
Network Connection
HTTP POST to target/index.php?option=com_sppagebuilder&task=asset.uploadCustomIconThe exploit upload endpoint. Connections are made only to the user-supplied target.poc_tot.go:234-235
File Write
Creates a PHP file inside a ZIP archive that is extracted to the target server's web-accessible media directory.This is the intended exploit payload delivery mechanism.poc_tot.go:146-204
Review boundaries

What the analysis did not establish

  • Evidence does not include the compiled binary; analysis is based solely on the provided Go source code and README.
  • The artifact contains non-text media files (screenshots) that were not analyzed.
  • The evidence packet reports complete_artifact_coverage as false, indicating additional files exist in the repository that were not included in the analysis.
  • The artifact includes 3 additional files (2 non-text, 1 text) that were not provided as readable text. Their content is unknown, but the analysis routing indicates they were flagged as metadata-only and not analyzed. The provided text files (README.md, poc_tot.go) constitute the complete selected text evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1