CVE Catalog
CVE-2026-67285
CriticalCVSS 9.2Exploitation Probability (EPSS)
Low risk0.38%
31th percentile - higher than 31% of all known CVEs
Summary
Joomla extension SP Page Builder before version 6.8.0 contains an unauthenticated arbitrary local PHP file inclusion vulnerability. An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.
Risk Assessment
An attacker can execute arbitrary local PHP files, potentially leading to code execution on the server, disclosure of sensitive data, or takeover of the application.
Recommendation
Update SP Page Builder to version 6.8.0 or later, which includes the fix.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.