The SP Page Builder extension for Joomla contains an unrestricted file upload vulnerability (CWE-434) that permits unauthenticated attackers to upload files of dangerous types, such as PHP scripts. Successful exploitation results in the ability to execute arbitrary PHP code on the affected system. This vulnerability affects all versions from 1.0.0 up to and including 6.6.1. The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

An attacker can upload and execute arbitrary PHP code on the server running the vulnerable SP Page Builder extension, potentially leading to full system compromise, data theft, or service disruption. The vulnerability requires no authentication and no user interaction, making it highly exploitable remotely. The critical CVSS score reflects the severe impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the upload functionality, disable the vulnerable extension if possible, or implement web application firewall rules to block malicious file uploads. Monitor official joomshaper.net channels for updates and patches.