External risk intelligence

Joomla SP Page Builder Arbitrary Local PHP File Inclusion

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-67285

This vulnerability affects a Joomla extension, which is a component of a web application. Joomla sites and their extensions are typically deployed as public-facing web services, making the application's attack surface internet-reachable by design.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability allows an unauthorized attacker to include arbitrary PHP files accessible by the system, potentially leading to serious security compromises. The technology affected is a Joomla extension, commonly used in web applications. The primary concern is to confirm if this extension is in use and assess potential exposure.

An attacker can trick the system into loading unintended files.
This impacts web application integrity and data security.
Confirm use and assess exposure to protect web assets.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by submitting specially crafted requests to a Joomla website that uses the affected SP Page Builder extension. This could allow them to include arbitrary PHP files from the server, potentially leading to unauthorized access or manipulation of the website.

No authentication is required.
An attacker triggers the vulnerability via crafted requests.
Risk includes arbitrary file access and system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to include arbitrary PHP files on the system when supported by the advisory. This could potentially expose sensitive information or lead to unauthorized code execution within the affected system.

System data may be exposed.
Arbitrary PHP file inclusion could occur.
Unauthorized code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for web application security and content management systems, such as platform or infrastructure teams, should address this vulnerability. The initial step involves identifying all instances of the affected Joomla extension, confirming their exposure to the internet and business criticality, and then planning remediation based on the identified risk.

Confirm web application and platform ownership.
Verify internet reachability and business impact.
Coordinate with vendor for updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SP Page Builder for Joomla?

SP Page Builder is a drag-and-drop extension for the Joomla content management system. It is used by web developers and site administrators to design complex page layouts and visual content without manually writing code, serving as a core structural component for many Joomla-based websites.

How does CVE-2026-67285 work as a vulnerability?

This vulnerability is classified as Improper Limitation of a Pathname to a Restricted Directory, or CWE-22. It occurs because the extension fails to properly validate user-supplied input, allowing an attacker to reference and include unauthorized PHP files stored elsewhere on the server that the application was never intended to access.

Do I need to be logged into the site to trigger this?

No. The flaw is unauthenticated, meaning an attacker does not need a valid user account or administrative privileges. It is triggered by sending specially crafted web requests to the server. Note that simply browsing the site normally or performing standard administrative tasks does not trigger the bug; it requires specific, malicious input designed to abuse the file inclusion flaw.

Is my site at risk if it uses this extension?

If you use SP Page Builder on a Joomla site, your risk is elevated. According to Halo Surface Signal, this extension is a component of a web application designed to be public-facing, meaning it is likely reachable from the internet. If your instance is internet-facing, it provides a direct path for attackers to reach the vulnerable code.

When should I take action for this CVE?

You should prioritize this immediately if you manage a Joomla site. Start by auditing your environment to confirm if SP Page Builder is installed and determine its version. Once identified, evaluate the criticality of the hosted content and coordinate with your technical team to apply official updates from the vendor to remediate the vulnerability.

References

www.joomshaper.com/page-builder

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.