The vulnerability identified as CVE-2026-67286 in the SP Page Builder extension for Joomla (versions =1.0.0-6.7.1) involves CWE-22, improper limitation of a pathname to a restricted directory. This flaw permits unauthenticated attackers to create arbitrary directories and files with predefined names, potentially leading to unauthorized file system modifications. The CVSS 4.0 base score is 6.3, indicating medium severity, with attack vector network, low attack complexity, no privileges required, no user interaction, and low impact on integrity. There is no vendor advisory or patch available at this time.

An unauthenticated attacker can create arbitrary directories and files on the server running the vulnerable SP Page Builder extension. This could allow unauthorized file system changes, which may lead to further exploitation or persistence. However, the impact on confidentiality, integrity, and availability is rated low to medium as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the Joomla extension or applying compensating controls to limit exposure.