GitHub Exploit Metadata - Exploit Intel

PoC files

10 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-14

Technical assessment

Python script that sends a crafted POST request to a vulnerable Joomla SP Page Builder endpoint to include an arbitrary local PHP file via path traversal, then verifies successful inclusion by checking for a proof marker file.

Backdoor review

No backdoor observed in reviewed code

The PoC for CVE-2026-67285 is a straightforward, well-documented local file inclusion exploit. The Python script sends a path traversal payload to a vulnerable Joomla endpoint and verifies success by checking for a proof file created by the included PHP code. All actions are consistent with the disclosed vulnerability and no deceptive, concealed, or unrelated harmful behavior is present.

ClassificationExploit

Model confidence100%

AuthenticationNot required

Languagespython

Target softwareJoomlaSP Page Builder

Attack typeslocal file inclusion

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The Python script (poc/poc.py) actively sends a malicious payload to a target to trigger a vulnerability (LFI) and verifies the resulting side-effect (creation of a proof file). This constitutes active exploitation, not just detection or scanning.

poc/poc.py:42-106README.md:60

Requirements

Target must be running a vulnerable version of SP Page Builder (1.0.0 - 6.7.1) on Joomla.README.md:10
A PHP file named 'site.php' must exist at a known filesystem path accessible by the web server (e.g., pre-staged by the lab environment).poc/poc.py:53-54

Observed behavior

Sends an HTTP POST request to the target's AJAX view endpoint with a path traversal payload in the 'addon[name]' parameter.poc/poc.py:48-59
Expects an HTTP 500 error response, indicating the target file was included but a subsequent class instantiation failed.poc/poc.py:76-80
Verifies successful exploitation by making a second HTTP request to check for a proof file created by the included PHP script.poc/poc.py:88-97

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url: http://127.0.0.1:26570Target URL for the PoC, supplied as a command-line argument. The README and PoC script both indicate this is the local lab instance.README.md:53poc/poc.py:110-112
Url: https://exploit-intel.comAuthor's website listed in the PoC script header. No requests are made to this URL by the exploit code.poc/poc.py:12
File Path: /tmp/eip-lfi-test/site.phpThe PHP file included via the LFI vulnerability. It is pre-staged by the lab Dockerfile and writes a proof marker to confirm successful exploitation.poc/poc.py:52-54
File Path: /var/www/html/tmp/eip-lfi-proof.txtThe proof file created by the included PHP code. The PoC checks for the 'EIP_LFI_SUCCESS' marker in this file to confirm successful exploitation.poc/poc.py:87-93

Review boundaries

What the analysis did not establish

One binary file (assets/com_sppagebuilder_v3_lite.zip) was not analyzed.
The analysis is based solely on the provided text files; the exploit code was not executed.
The exploit's success depends on a pre-staged file ('/tmp/eip-lfi-test/site.php') which is part of the lab setup, not a general target environment.
The binary file 'assets/com_sppagebuilder_v3_lite.zip' was not inspected. It is used for lab setup, not executed by the PoC, and its metadata does not indicate a risk.
The pre-staged PHP file '/tmp/eip-lfi-test/site.php' is not included in the text evidence, so its exact content is unknown. However, the PoC's verification logic only checks for a specific success string in a proof file, which is consistent with a benign proof-of-concept.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

CVE-2026-67285/docker-compose.yml

Created 2026-05-19Vuln labCVE-2026-67285Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

Analysisdeepseek-v4-pro:cloud · 2026-08-13

Environment assessment

A Docker Compose environment for reproducing CVE-2026-67285, an unauthenticated local file inclusion (LFI) vulnerability in the JoomShaper SP Page Builder extension for Joomla. It consists of a Joomla 3.10 web server with the vulnerable SP Page Builder v3-lite v2.5.1 extension and a MariaDB 10.4 database.

CVE-2026-67285/docker-compose.yml:1-41CVE-2026-67285/Dockerfile.vulnerable:1-21CVE-2026-67285/README.md:1-68

Lab assessment

Vulnerability lab

The README explicitly describes the unit as a lab for CVE-2026-67285, providing a Docker Compose file, a vulnerable Dockerfile, a PoC script, and a seed script to set up the vulnerable Joomla instance and demonstrate the LFI.

CVE-2026-67285/README.md:1-68CVE-2026-67285/docker-compose.yml:1-41CVE-2026-67285/Dockerfile.vulnerable:1-21

Lab shapeCompose · mixed

Services2

Compose manifests1

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

web

vulnerable Joomla application serverLFI target

A Joomla 3.10-php7.4-apache container with the vulnerable SP Page Builder v3-lite v2.5.1 extension installed. It exposes port 80 on a host port (default 26570). The Dockerfile pre-stages an LFI test file at /tmp/eip-lfi-test/site.php that writes a proof marker to /var/www/html/tmp/eip-lfi-proof.txt when included.

CVE-2026-67285/docker-compose.yml:2-27CVE-2026-67285/Dockerfile.vulnerable:1-21

db

Joomla database

A MariaDB 10.4 container that stores the Joomla database. It is configured with a health check and credentials used by the web service.

CVE-2026-67285/docker-compose.yml:29-38

seed.sh

lab setup automation

A shell script that automates the installation of Joomla and the SP Page Builder extension into the running containers using docker exec. It also sets up the LFI test file and verifies the installation.

CVE-2026-67285/seed.sh:1-111

poc.py

LFI exploit PoC

A Python 3 script that sends a POST request to the vulnerable AJAX endpoint with a path traversal payload to include the pre-staged /tmp/eip-lfi-test/site.php file, then verifies successful inclusion by checking for the proof marker via HTTP.

CVE-2026-67285/poc/poc.py:1-116

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-67285

Supported by supplied evidence

The packet provides a complete lab environment, a PoC exploit, and a verification report that demonstrate an unauthenticated LFI in SP Page Builder via the AJAX view handler, consistent with the CVE description. The PoC targets the lab's own web container and verifies arbitrary PHP file inclusion.

CVE-2026-67285/README.md:1-68CVE-2026-67285/poc/poc.py:1-116CVE-2026-67285/poc_verification_report.md:1-26

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker and Docker Compose must be installed to build and run the lab.CVE-2026-67285/README.md:47-49
The host must expose a port (default 26570) for the Joomla web service.CVE-2026-67285/docker-compose.yml:7
The seed.sh script requires docker exec access to the running containers to install Joomla and the extension.CVE-2026-67285/seed.sh:1-111
The PoC requires Python 3 with standard libraries and network access to the target Joomla instance.CVE-2026-67285/poc/poc.py:1-116

Evidence-described exercise path

Build and start the lab containers using 'docker compose up -d --build' from the publish directory.CVE-2026-67285/README.md:47-49
Run 'bash seed.sh' to install Joomla, the SP Page Builder extension, and set up the LFI test file inside the containers.CVE-2026-67285/README.md:52-53
Execute the PoC with 'python3 poc/poc.py http://127.0.0.1:26570' to trigger the LFI and verify success.CVE-2026-67285/README.md:56

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab's own containers. The PoC sends an LFI payload to the local Joomla instance and checks for a proof file. The seed script uses docker exec to configure the lab containers, which is a documented prerequisite. No host compromise, external communication, persistence, or destructive actions are observed.

CVE-2026-67285/poc/poc.py:1-116CVE-2026-67285/seed.sh:1-111

Review boundaries

What the analysis did not establish

The file CVE-2026-67285/assets/com_sppagebuilder_v3_lite.zip is a binary and was not inspected; its contents are assumed to match the described SP Page Builder extension based on the SHA256 hash check in the Dockerfile.
The file CVE-2026-67285/assets/configuration.php was not included in the evidence text; its contents are unknown.
The files intel_brief.md and vulnerability_analysis.md were not included in the evidence text; their contents are unknown.
The PoC verification report references artifacts/poc_run.txt and artifacts/control_run.txt which are not included in the packet.
The CVE association notes a conflict: the unit path is CVE-2026-67285, but the Dockerfile and README also reference CVE-2026-48908. Only CVE-2026-67285 was selected for assessment per the unit_cve_ids.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted