Joomla Extensions Under Active Attack: CVE-2026-48908, CVE-2026-48939, CVE-2026-56291 Added to CISA KEV (CVSS 10.0)

Three critical vulnerabilities in popular Joomla extensions have been added to the CISA Known Exploited Vulnerabilities (KEV) catalog following confirmed active exploitation. All three carry CVSS base scores of 10.0 — the maximum possible severity — and all three share the same root vulnerability class: unrestricted file upload that enables unauthenticated remote code execution. If you run a Joomla site with any of these extensions, this is a drop-everything security event.

The Three CVEs: What They Are and What Attackers Are Doing

CVE-2026-48908 (JoomShaper SP Page Builder — CVSS 10.0)

SP Page Builder is one of the most widely deployed Joomla drag-and-drop page builder extensions, with millions of installations globally. CVE-2026-48908 is an unrestricted upload vulnerability in the extension's custom icon upload endpoint. An unauthenticated attacker can send a crafted HTTP POST request to index.php?option=com_sppagebuilder&task=asset.uploadCustomIcon containing an arbitrary PHP file. The server processes the upload without validating the file type or content, writes the PHP file to a publicly accessible directory, and the attacker then triggers execution via a simple GET request to the uploaded file path.

Active exploitation of CVE-2026-48908 has led to the creation of new Super User accounts in the Joomla administrator panel, effectively giving attackers full administrative control of affected sites. From there, attackers have installed persistent backdoors, exfiltrated configuration files (including database credentials), and used compromised sites as staging infrastructure for further attacks.

CVE-2026-48939 (iCagenda Events Extension — CVSS 10.0)

iCagenda is a popular Joomla event management extension used extensively by government portals, educational institutions, and event-based businesses. The vulnerability exists in the extension's "Submit an Event" feature — a form that allows public users to propose events for review. The file upload handler in this form does not restrict file types, allowing an unauthenticated attacker to upload a PHP webshell disguised as an event image.

Exploitation of CVE-2026-48939 has been observed in automated attack campaigns since at least June 15, 2026 — making it a zero-day that was exploited in the wild before being publicly disclosed and catalogued. Security researchers at mySites.guru confirmed that automated scanning tools were probing for vulnerable iCagenda installations within hours of the vulnerability being disclosed, and the CISA KEV addition confirms that exploitation is widespread.

CVE-2026-56291 (Balbooa Forms — CVSS 10.0)

Balbooa Forms is a Joomla form builder extension used to create contact forms, registration pages, and data collection forms. CVE-2026-56291 was identified on July 8, 2026, when mySites.guru detected an active attack against one of its managed client sites. As with the other two CVEs, the vulnerability allows unauthenticated attackers to upload arbitrary PHP files through a form submission endpoint.

Following discovery, CISA added CVE-2026-56291 to the KEV catalog with a remediation deadline of July 13, 2026. For federal civilian agencies in the US, that deadline has passed. For all other organisations, it functions as a strong signal that exploitation is confirmed and active.

Why These Vulnerabilities Are Particularly Dangerous

Unrestricted file upload vulnerabilities in web applications occupy the top tier of web security risk for a reason. The attack chain is short, requires no credentials, and results in full code execution on the server — not merely data exposure. Once a PHP webshell is planted, an attacker has an interactive backdoor that persists through application updates, server reboots, and even reinstallation of the vulnerable extension if the webshell file is not explicitly removed.

The Joomla CMS ecosystem is particularly exposed because the platform's extension marketplace has historically had inconsistent security review processes. Unlike WordPress, which now has mandatory code review for plugins in its official repository, many Joomla extensions pass through lighter gatekeeping. The result is a long tail of popular, widely deployed extensions that have not been subject to systematic security testing.

All three of these vulnerabilities were exploited before patches were available, meaning organisations had zero time between disclosure and active attack. This is the risk profile that justifies continuous VAPT and vulnerability monitoring rather than point-in-time scanning.

Affected Versions and Remediation

For CVE-2026-48908 (JoomShaper SP Page Builder): Update to SP Page Builder version 4.3.0 or later. If an immediate update is not possible, disable the custom icon upload feature by restricting access to the affected endpoint via your web server configuration, or take the component offline until the patch can be applied.

For CVE-2026-48939 (iCagenda): Update to the latest version of iCagenda available from the JoomShaper marketplace. Check the tmp and images/icalendar directories for any .php files — their presence indicates prior compromise. Review Joomla Super User accounts for unexpected additions.

For CVE-2026-56291 (Balbooa Forms): Update to the latest Balbooa Forms version. Audit the images/baforms/uploads directory for non-image and non-document files. Any .php, .phtml, .phar, or .pht files in this directory should be treated as indicators of compromise (IOC) and the site should be taken offline for forensic investigation.

Across all three, a full post-compromise assessment is strongly recommended if your site ran any of these extensions before patching. Given that exploitation has been ongoing since at least mid-June for CVE-2026-48939, many sites that appear functional may already be backdoored.

Indicators of Compromise to Look For

Security teams investigating potentially compromised Joomla installations should look for: unexpected PHP files in upload directories (images, media, tmp); new or modified Super User accounts in the Joomla admin panel; unusual outbound network connections from the web server process; access log entries showing POST requests to the vulnerable endpoints followed by GET requests to uploaded file paths; and modified .htaccess files or web.config files that redirect traffic or disable security controls.

The 180-day log retention requirement under CERT-In's 2022 Directions means Indian organisations should have sufficient access log history to determine whether exploitation has occurred. If logs show successful POSTs to the affected endpoints, treat the site as compromised and initiate incident response.

What This Means for VAPT Scope

These three CVEs illustrate a critical gap in most organisations' VAPT programmes: third-party extension security. Traditional VAPT engagements often test the Joomla core application and custom-built functionality but do not systematically test every installed extension. Given that the average Joomla site runs fifteen to thirty extensions — many of which have public-facing file upload functionality — this creates an enormous untested attack surface.

Alastor Pulse, our PTaaS dashboard, includes continuous scanning of third-party CMS components and extensions as part of the attack surface monitoring scope. When a new CVE is published for an installed extension, Alastor Pulse flags the affected assets within hours and initiates an automated verification test — the same zero-day response that manual annual VAPT simply cannot provide.

To assess whether your Joomla installations are exposed, or to begin continuous VAPT coverage of your web application estate, contact us at support@alastorinfosec.com or see Alastor Pulse.

Three CVSS 10.0 vulnerabilities in widely deployed Joomla extensions — all exploited before patches were available — are a reminder that the only effective defence against zero-day exploitation is continuous monitoring and rapid response, not annual testing.