CVE-2026-67285

CRITICAL

Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-67285 has a selected CVSS score of 9.2 (critical); EIP currently links 1 curated repository PoC and 1 lab environment.

Description

Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 12, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

SP Page Builder extension for Joomla

Browse joomshaper.com / SP Page Builder extension for Joomla

Default status: unaffected

CVE List1.0.0-6.7.1affected

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2026-67285Curated repository PoCby exploitintel8Not analyzed10 files

C · 2.5 MiB · linked to 2 vulnerabilities

GitHub
PoC details

Docker lab environments

1
GitHub

CVE-2026-67285/docker-compose.yml

CVE-2026-67285Created Vuln labCVE-2026-67285Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for reproducing CVE-2026-67285, an unauthenticated local file inclusion (LFI) vulnerability in the JoomShaper SP Page Builder extension for Joomla. It consists of a Joomla 3.10 web server with the vulnerable SP Page Builder v3-lite v2.5.1 extension and a MariaDB 10.4 database.

CVE-2026-67285/docker-compose.yml:1-41CVE-2026-67285/Dockerfile.vulnerable:1-21CVE-2026-67285/README.md:1-68

Lab assessment

Vulnerability lab

The README explicitly describes the unit as a lab for CVE-2026-67285, providing a Docker Compose file, a vulnerable Dockerfile, a PoC script, and a seed script to set up the vulnerable Joomla instance and demonstrate the LFI.

CVE-2026-67285/README.md:1-68CVE-2026-67285/docker-compose.yml:1-41CVE-2026-67285/Dockerfile.vulnerable:1-21
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

web

vulnerable Joomla application serverLFI target

A Joomla 3.10-php7.4-apache container with the vulnerable SP Page Builder v3-lite v2.5.1 extension installed. It exposes port 80 on a host port (default 26570). The Dockerfile pre-stages an LFI test file at /tmp/eip-lfi-test/site.php that writes a proof marker to /var/www/html/tmp/eip-lfi-proof.txt when included.

CVE-2026-67285/docker-compose.yml:2-27CVE-2026-67285/Dockerfile.vulnerable:1-21

db

Joomla database

A MariaDB 10.4 container that stores the Joomla database. It is configured with a health check and credentials used by the web service.

CVE-2026-67285/docker-compose.yml:29-38

seed.sh

lab setup automation

A shell script that automates the installation of Joomla and the SP Page Builder extension into the running containers using docker exec. It also sets up the LFI test file and verifies the installation.

CVE-2026-67285/seed.sh:1-111

poc.py

LFI exploit PoC

A Python 3 script that sends a POST request to the vulnerable AJAX endpoint with a path traversal payload to include the pre-staged /tmp/eip-lfi-test/site.php file, then verifies successful inclusion by checking for the proof marker via HTTP.

CVE-2026-67285/poc/poc.py:1-116
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-67285

Supported by supplied evidence

The packet provides a complete lab environment, a PoC exploit, and a verification report that demonstrate an unauthenticated LFI in SP Page Builder via the AJAX view handler, consistent with the CVE description. The PoC targets the lab's own web container and verifies arbitrary PHP file inclusion.

CVE-2026-67285/README.md:1-68CVE-2026-67285/poc/poc.py:1-116CVE-2026-67285/poc_verification_report.md:1-26
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the lab.CVE-2026-67285/README.md:47-49
  • The host must expose a port (default 26570) for the Joomla web service.CVE-2026-67285/docker-compose.yml:7
  • The seed.sh script requires docker exec access to the running containers to install Joomla and the extension.CVE-2026-67285/seed.sh:1-111
  • The PoC requires Python 3 with standard libraries and network access to the target Joomla instance.CVE-2026-67285/poc/poc.py:1-116

Evidence-described exercise path

  1. Build and start the lab containers using 'docker compose up -d --build' from the publish directory.CVE-2026-67285/README.md:47-49
  2. Run 'bash seed.sh' to install Joomla, the SP Page Builder extension, and set up the LFI test file inside the containers.CVE-2026-67285/README.md:52-53
  3. Execute the PoC with 'python3 poc/poc.py http://127.0.0.1:26570' to trigger the LFI and verify success.CVE-2026-67285/README.md:56
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab's own containers. The PoC sends an LFI payload to the local Joomla instance and checks for a proof file. The seed script uses docker exec to configure the lab containers, which is a documented prerequisite. No host compromise, external communication, persistence, or destructive actions are observed.

CVE-2026-67285/poc/poc.py:1-116CVE-2026-67285/seed.sh:1-111
Review boundaries

What the analysis did not establish

  • The file CVE-2026-67285/assets/com_sppagebuilder_v3_lite.zip is a binary and was not inspected; its contents are assumed to match the described SP Page Builder extension based on the SHA256 hash check in the Dockerfile.
  • The file CVE-2026-67285/assets/configuration.php was not included in the evidence text; its contents are unknown.
  • The files intel_brief.md and vulnerability_analysis.md were not included in the evidence text; their contents are unknown.
  • The PoC verification report references artifacts/poc_run.txt and artifacts/control_run.txt which are not included in the packet.
  • The CVE association notes a conflict: the unit path is CVE-2026-67285, but the Dockerfile and README also reference CVE-2026-48908. Only CVE-2026-67285 was selected for assessment per the unit_cve_ids.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

References

2