The SP Page Builder extension for Joomla versions 1.0.0 through 6.7.1 suffers from an unauthenticated arbitrary local PHP file inclusion vulnerability (CWE-22). This flaw allows attackers without any privileges to include arbitrary PHP files that the system can access, due to improper restriction of pathname inputs. The vulnerability is critical with a CVSS 4.0 score of 9.2, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not yet published an official fix or remediation guidance. The vulnerability was reserved on 2026-07-29 and published on 2026-08-12. There are no known exploits in the wild currently.

Successful exploitation allows unauthenticated attackers to include arbitrary local PHP files, potentially leading to remote code execution, data disclosure, or system compromise. The high CVSS score (9.2) reflects the critical nature of this vulnerability impacting confidentiality, integrity, and availability without requiring authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable extension to mitigate risk. Monitor vendor communications for updates on patches or temporary mitigations.