bayu06802/CVE-2026-48908

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2026-48908, an unauthenticated arbitrary file upload vulnerability in the SP Page Builder Joomla component, to achieve remote code execution by uploading a PHP web shell inside a crafted ZIP archive.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward exploit for CVE-2026-48908. It uploads a ZIP containing a token-guarded PHP webshell to a vulnerable Joomla component. The code is readable, performs only the described exploit steps, and contains no concealed or unrelated harmful behavior.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareSP Page Builder (com_sppagebuilder) for Joomla
Attack typesRemote Code ExecutionArbitrary File Upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a fully functional Python script that actively exploits the vulnerability by uploading a malicious ZIP file containing a PHP web shell to the target server and then executing commands on it. This goes beyond detection or scanning; it performs the exploitation steps to achieve remote code execution.

sppb_rce.py:1-5sppb_rce.py:85-107sppb_rce.py:115-140

Requirements

  • Target must be running a vulnerable version of SP Page Builder (1.0.0 – 6.6.1) for Joomla.README.md:12
  • The target's web server must allow PHP execution in the /media/ directory for full RCE, or at least allow file writes for partial impact.README.md:68-70

Observed behavior

  • Sends an unauthenticated POST request to the vulnerable endpoint (index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon) with a crafted ZIP file containing a PHP web shell.sppb_rce.py:85-102
  • The ZIP file is constructed to mimic a valid icon-font package (selection.json, style.css, fonts/*.ttf) to pass the upload validation, while also containing a token-guarded PHP shell.sppb_rce.py:63-82
  • Attempts multiple file extension and .htaccess bypass techniques to achieve code execution, stopping at the first successful method.sppb_rce.py:115-140
  • Executes arbitrary system commands on the target server via the uploaded web shell and returns the output.sppb_rce.py:105-107sppb_rce.py:200-207
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Token Guarded Webshell
<?php if(($_GET["t"]??"")==="%s"){@system($_GET["c"]??"id");} else {http_response_code(404);} ?>The dropped webshell is guarded by a random per-run token, preventing unauthorized access. This is a safety feature, not a backdoor.sppb_rce.py:65-66
Cleanup Functionality
--cleanup flag deletes uploaded payload directoriesThe script includes a cleanup option to remove the artifacts it creates, which is consistent with authorized testing and not indicative of a backdoor.sppb_rce.py:209-216
Default Command
idThe default command executed is benign (id), and the script only runs commands supplied by the operator.sppb_rce.py:148
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository are included. One file (likely the LICENSE file) is omitted from the text content, but this does not affect the classification of the primary exploit script.
  • One file (LICENSE) was omitted from the text evidence; its content is not reviewed, but it is a standard license file and unlikely to contain executable behavior.
  • The review is based solely on the supplied text; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1