CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.
Explanation of Vulnerability in Simple Terms
SP Page Builder for Joomla contains a path traversal vulnerability that allows an attacker to read files outside the intended directory. The vulnerability requires specific timing conditions to exploit but does not require authentication or user interaction. Affected versions are 1.0.0 through 6.7.1. Site administrators should update to a version newer than 6.7.1 when available.
What an attacker can do
Read arbitrary files from the server outside the intended directory.
Potential impact on your site
Sensitive files (config, database credentials, private keys) may be exposed to unauthenticated attackers.
Conditions required to exploit
Network access to the site; specific timing conditions must be met (AT:P).
Key dates
External resources
Related vulnerabilities
