CVE-2026-65878 HIGH

CVE-2026-65878: Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1

Vendor Joomshaper.com
Product SP Page Builder extension for Joomla
Weakness CWE-22 · Path traversal
Published July 27, 2026
Last update July 27, 2026
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

What the vulnerability does

01Description

Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager.

Explanation of Vulnerability in Simple Terms

02Summary

SP Page Builder for Joomla contains a path traversal vulnerability that allows high-privileged users to read or modify files outside the intended directory. An attacker with administrator access can exploit this to access sensitive configuration files or alter site content. Update to a version newer than 1.0.0-6.7.0 to resolve this issue.

What an attacker can do

03Attacker Capabilities

Read or modify files outside the intended directory on the server.

Potential impact on your site

04Site Impact

Administrators with malicious intent or compromised admin accounts can access sensitive files or alter site data.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the Joomla site.

Key dates

06Disclosure timeline

July 27, 2026 CVE published