CVE-2026-65877 is an authenticated SQL injection vulnerability in the SP Page Builder extension for Joomla, affecting versions from 1.0.0 up to 6.7.0. The issue arises due to improper neutralization of special elements in SQL commands, specifically in the media manager's search and date filter parameters. An attacker with high privileges can exploit this flaw to execute arbitrary SQL commands, potentially compromising the confidentiality and integrity of the database. The vulnerability has a CVSS 4.0 score of 8.2, indicating a high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity with scope change. No known exploits in the wild have been reported, and no official patch or remediation level has been disclosed by the vendor as of the publication date.

Successful exploitation allows an authenticated user with high privileges to perform SQL injection attacks via the media manager search and date filters. This can lead to unauthorized access or modification of database information, impacting confidentiality and integrity with a high severity level. The scope of the impact is high, indicating potential effects beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the media manager features to trusted users only and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the affected functionality to untrusted users.