The SP LMS (com_splms) extension for Joomla versions 1.0.0 up to 4.1.3 contains a deserialization of untrusted data vulnerability. Specifically, it deserializes user-controlled cookie data without validation, which can be exploited by unauthenticated remote attackers to execute arbitrary code on the server. This vulnerability is tracked as CVE-2026-48909 and is classified under CWE-502. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, availability, and security requirements. No vendor advisory or patch is currently available.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the affected server, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the system hosting the SP LMS extension.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the vulnerable extension or restricting access to it to trusted users only to reduce exposure.