papageo75/CVE-2026-48908-PoC

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script (sppb_rce.py) that exploits CVE-2026-48908, an unauthenticated arbitrary file upload vulnerability in the SP Page Builder Joomla component, to achieve remote code execution. It uploads a crafted ZIP archive containing a PHP web shell to a publicly accessible directory and then executes commands via HTTP requests.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward exploit for CVE-2026-48908. It uploads a ZIP containing a token-guarded PHP webshell to a vulnerable Joomla component. The shell only executes commands when the correct token is supplied, and the script includes a cleanup function. No concealed backdoor, unrelated payload, or deceptive behavior was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareSP Page Builder for Joomla
Attack typesremote_code_executionarbitrary_file_upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a fully functional Python script that actively exploits CVE-2026-48908 by uploading a malicious ZIP file containing a PHP web shell and then executing arbitrary commands on the target server. It is not merely a scanner or writeup; it performs the exploitation steps to achieve remote code execution.

sppb_rce.py:1-223README.md:1-5

Requirements

  • Target must run a vulnerable version of SP Page Builder (<= 6.6.1) with the uploadCustomIcon task accessible without authentication.sppb_rce.py:8-12
  • The web server must allow PHP execution in the upload directory, or AllowOverride must be enabled for the .htaccess bypass method.README.md:45-49

Observed behavior

  • Sends an unauthenticated POST request to index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon with a crafted ZIP file containing a PHP web shell.sppb_rce.py:85-102
  • Iterates through a list of PHP file extensions and a .htaccess bypass method, uploading a shell and checking for code execution by requesting the shell with a token and a test command.sppb_rce.py:115-140
  • If code execution is confirmed, runs a user-specified command or provides an interactive pseudo-shell by sending HTTP requests to the uploaded web shell.sppb_rce.py:189-207
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Token Guarded Webshell
<?php if(($_GET["t"]??"")==="%s"){@system($_GET["c"]??"id");} else {http_response_code(404);} ?>The uploaded PHP shell is guarded by a random per-run token, preventing unauthorized access.sppb_rce.py:65-66
Cleanup Function
rm -rf command to delete uploaded directoriesThe script provides a --cleanup option to remove the payload directories it created.sppb_rce.py:209-216
Disclaimer
Educational purposes and authorized security testing onlyThe README and script header contain disclaimers stating the tool is for authorized testing only.README.md:160-177sppb_rce.py:28-29
Review boundaries

What the analysis did not establish

  • Two files (LICENSE and .gitignore) are omitted from the text evidence, but they are not required for technical analysis of the exploit code.
  • The evidence does not include the actual execution of the exploit; classification is based solely on static analysis of the provided source code.
  • Two files (LICENSE and an unspecified file) were omitted from the text content and not reviewed, but their metadata shows no executable or suspicious characteristics.
  • The review is based solely on the supplied text evidence; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1