CVE Catalog
CVE-2026-67286
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk0.38%
31th percentile - higher than 31% of all known CVEs
Summary
In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create arbitrary directories and files with a predefined name.
Risk Assessment
This could allow placing malicious files on the server, potentially leading to site compromise.
Recommendation
Update SP Page Builder to 6.8.0 or later and restrict write permissions in directories.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name.