SP Page Builder (com_sppagebuilder) 6.7.1 to 6.7.x - CVE-2026-67285 and CVE-2026-67286 Unauthenticated Remote Code Execution (PHP file inclusion, CVSS 9.3) plus CVE-2026-65876 Unauthenticated SQL Injection - fixed in 6.8.0

SP Page Builder 6.7.1 and earlier contain a pre-authentication remote code execution flaw and an unauthenticated SQL injection. Both are fixed in 6.8.0, released 12 August 2026. mySites.guru re-tested the released 6.8.0 package the same day and confirmed both are closed. Update to 6.8.0 or later now. 1) Unauthenticated PHP file inclusion, leading to remote code execution (CVE-2026-67285 / CVE-2026-67286, CVSS 4.0 9.3 Critical). The front-end task dynamic_content.loadMoreCollectionData renders an addon definition supplied in the request body itself. The addon name from that definition was concatenated into a filesystem path and then included and executed as PHP, with no directory traversal check. The endpoint is gated only by a CSRF token, which Joomla issues to every anonymous visitor, so it is reachable pre-authentication. An attacker could make the site execute a PHP file from any path the web server can read, inside or outside the web root, which becomes full remote code execution wherever any attacker-influenced PHP file exists. A second issue on the same endpoint let an anonymous request create a directory and write a file outside the cache folder, because the addon id was also used unchecked as a filesystem path. Reported privately to JoomShaper by mySites.guru on 27 July 2026 and confirmed by exploitation on a test install. The vulnerable code is present in 6.7.1 and, from testing, in every release back to 5.5.0 where Dynamic Content was introduced. 2) Unauthenticated SQL injection in the article loading endpoint (CVE-2026-65876). The task articles.loadMoreArticles read its parameters from the raw JSON request body with no login and no permission check, and passed catid unfiltered into a SQL IN() clause. The 6.7.1 release was credited with fixing this but did not: the integer sanitisation ran one line after the raw value had already reached the query. 6.8.0 applies the cast correctly. This one was not found by mySites.guru, but the incomplete 6.7.1 patch was confirmed by reading the shipping package on 10 August 2026 and the 6.8.0 fix was confirmed on 12 August 2026. Note that the 6.8.0 release notes describe the code execution fix only as "Hardened input validation, file handling, and access checks across the component", with no severity, no CVE and no indication of urgency. Treat this as a critical update regardless of how the changelog reads. Because the file inclusion allows code execution without a login, any site that ran a vulnerable version while internet-facing should be treated as potentially compromised until checked: look for unexpected files and administrator accounts, rotate the Joomla secret and stored credentials, and restore from a known-good backup if anything looks wrong. This is separate from CVE-2026-65766, the Dynamic Content ORDER BY injection, which was genuinely fixed in 6.7.1 and is covered by the 6.0.0 to 6.7.0 rule.

How CVE-2026-67286 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

The rule below is rated Critical for the set of 4 CVEs it covers together, not for this record on its own.

Timeline

1. 27 July 2026We published: Pre-Authentication SQL Injection and Mail Relay in SP Page Builder found by mySites.guru
2. 12 August 2026CVE-2026-67286 record published by its CNA
3. 12 August 2026mySites.guru check added for SP Page Builder (from 6.7.1 up to but not including 6.8.0)

Rule details

Our disclosure post

Pre-Authentication SQL Injection and Mail Relay in SP Page Builder found by mySites.guru

mySites.guru found four vulnerabilities in SP Page Builder for Joomla: a SQL injection and a mail relay, fixed in 6.7.1. A fifth was still there until 6.8.0.

27 Jul 2026

Other vulnerabilities in SP Page Builder

Updating for CVE-2026-67286 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

References

• CVE-2026-67286 on cve.org (the official CVE record)
• CVE-2026-67286 in the NIST National Vulnerability Database
• Pre-Authentication SQL Injection and Mail Relay in SP Page Builder found by mySites.guru