Unauthenticated Directory Creation and File Write Vulnerability in SP Page Builder by JoomShaper
CVE-2026-67286

6.3MEDIUM

Key Information:

Vendor

Joomshaper.com

Status
Sp Page Builder Extension For Joomla
Vendor
CVE Published:
12 August 2026

What is CVE-2026-67286?

A vulnerability in the SP Page Builder extension allows unauthenticated attackers to create arbitrary directories and files on the server with predefined names. This issue arises in versions prior to 6.8.0 and poses a significant security risk, enabling malicious users to manipulate the server’s filesystem without authentication. Proper mitigation and updates are essential to protect against potential exploitation.

Affected Version(s)

SP Page Builder extension for Joomla 1.0.0-6.7.1

References

https://www.joomshaper.com/page-builder
product

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phil Taylor, mysites.guru
.