CVSS v3
—
Unknown
EPSS Score
0.7%
exploit probability
CISA KEV
Yes
known exploited
Exploitation
—
SSVC status
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
Yes. CVE-2026-48908 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 7/10/2026.
A CVSS score has not been assigned to CVE-2026-48908 yet.
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.