Security readout for executives and security teams
Plain-English summary
SP Page Builder versions 1.0.0 through 6.7.1 contain a critical flaw allowing an unauthenticated remote attacker to make Joomla include accessible local PHP files. Successful exploitation could severely affect the website’s confidentiality, integrity, and availability. Publicly reachable sites using affected versions should be treated as urgent.
Executive priority
Prioritize immediate identification and remediation of Internet-facing affected sites. Because exploitation needs neither credentials nor user action and could cause full business-impact categories, exposed systems warrant emergency change handling. Absence from KEV does not establish safety; it only means the supplied evidence does not confirm known active exploitation.
Technical view
CVE-2026-67285 is a CWE-22 local file inclusion vulnerability in the Joomla SP Page Builder extension before 6.8.0. It is network-accessible, requires no privileges or user interaction, and has an unspecified attack precondition. The CVSS 4.0 score is 9.2, with high vulnerable-system impacts across confidentiality, integrity, and availability.
Likely exposure
Exposure is most likely where Joomla runs SP Page Builder 1.0.0 through 6.7.1 and attacker-controlled requests can reach the affected extension. Risk increases for Internet-facing sites and systems containing accessible PHP files. The supplied sources do not identify the vulnerable endpoint or required precondition.
Exploitation context
The CVE is not listed as KEV in the supplied bundle, and no cited source confirms active exploitation or a public exploit. Exploitation nevertheless requires no authentication or user interaction. The CVSS vector records an additional attack requirement, but available evidence does not explain it.
Researcher notes
The public bundle is sparse: it identifies arbitrary inclusion of system-accessible local PHP files but not the endpoint, precondition, root cause details, indicators, or exploitation observations. The affected range is explicitly 1.0.0–6.7.1, while the title describes versions below 6.8.0. Avoid broader version claims without updated vendor or CVE evidence.
Mitigation direction
- Upgrade SP Page Builder to version 6.8.0 or later after confirming vendor compatibility guidance.
- Restrict public access to affected Joomla installations until upgrading if operationally feasible.
- Review JoomShaper and CVE guidance for newly published mitigations or incident indicators.
- Preserve relevant web, application, and system logs before remediation.
Validation and detection
- Inventory Joomla sites and confirm each installed SP Page Builder version.
- Verify affected versions are no longer reachable from untrusted networks.
- Review logs for anomalous requests involving SP Page Builder and unexpected local PHP file references.
- Assess affected hosts for unauthorized changes or other evidence of compromise.
- Confirm the deployed extension version remains 6.8.0 or later after recovery and redeployment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-67285 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——JoomlaVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.joomshaper.com/page-builderCVE reference, Joomla · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.