JoomShaper SP Page Builder unauth file-upload RCE (CVSS 10.0), CISA KEV zero-day

CVE-2026-48908 / CVE-2026-56290, two Joomla page-builder extensions hit CISA KEV the same day for unauth file-upload RCE zero-days

Two unrelated third-party Joomla page-builder extensions were both added to CISA KEV on 7 July 2026 for near-identical unauthenticated file-upload-to-RCE flaws, both already exploited as zero-days. CVE-2026-48908 (JoomShaper SP Page Builder, CVSS 10.0, CWE-434) sits in the component's asset.uploadCustomIcon task, reachable at index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon with no authentication and no file-type validation, affecting versions through 6.6.1 (fixed 6.6.2); mySites.guru observed live attacks planting hidden Super Administrator accounts (typically @secure.local) for persistence surviving the entry-point patch (mySites.guru, 2026-07-08). CVE-2026-56290 (Joomlack Page Builder CK, CVSS 10.0, CWE-284) is a front-end upload handler that validated only a CSRF token (no authentication, no authorization) and accepted an attacker-controlled destination folder and filename including the extension, letting a PHP file be written and executed anywhere web-accessible; it affects up to 3.5.10, fixed in 3.6.0 with back-ports to 3.1.1 (Joomla 3) and 3.4.10 (Joomla 4), and the vendor's own suspect-content tooling flagged a live web shell within hours of the fix landing (mySites.guru, 2026-07-07). The Hacker News corroborates both as KEV-listed and actively exploited (The Hacker News, 2026-07-08).