The SP Page Builder extension for Joomla contains a path traversal vulnerability (CWE-22) that enables authenticated users with high privileges to delete arbitrary files due to improper limitation of pathnames to restricted directories. This flaw exists in versions 1.0.0 through 6.7.0 and arises from insufficient path validation and access control checks in the media manager component. The vulnerability has a CVSS 4.0 score of 8.3, indicating high severity. There is no vendor advisory or patch information currently available to confirm remediation status.

An authenticated user with high privileges can exploit this vulnerability to delete arbitrary files on the server hosting the Joomla SP Page Builder extension. This could lead to denial of service or disruption of website functionality. The vulnerability requires authentication and high privileges, limiting the attack surface to authorized users. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the media manager to trusted administrators only and monitor for suspicious file deletion activity. Avoid granting unnecessary high privileges to users.