Skip to content

Joomla extension KEV exploitation cluster

Summary

CISA added two Joomla page-builder vulnerabilities to the Known Exploited Vulnerabilities catalog on July 7, 2026: CVE-2026-48908 in JoomShaper SP Page Builder and CVE-2026-56290 in Joomlack Page Builder. Both entries describe unauthenticated arbitrary file upload paths that can lead to PHP code execution.

On July 10, 2026, CISA added two more Joomla-extension arbitrary-file-upload KEVs: CVE-2026-56291 in Balbooa Forms and CVE-2026-48939 in iCagenda. The four-entry cluster is a useful defensive signal: internet-facing Joomla extension exposure should be triaged as a CMS web-shell risk, not as isolated plugin patch work.

The clustered KEV additions are high-signal because Joomla extension exposure often sits on internet-facing marketing, commerce, education, and public-sector sites where PHP upload-to-execution flaws rapidly become web-shell, traffic-distribution, phishing, SEO-poisoning, or credential-theft infrastructure.

Tags

Balbooa Forms / iCagenda update

The July 10 CISA KEV additions broaden the active-exploitation set from page builders to form/calendar Joomla extensions. Balbooa Forms and iCagenda should be prioritized alongside the July 7 JoomShaper and Joomlack entries because all four flaws center on arbitrary file upload into a PHP CMS context.

Why this matters

  • CISA's KEV entry for CVE-2026-48908 says unauthenticated users can upload arbitrary files to JoomShaper SP Page Builder, ultimately resulting in upload and execution of PHP code.
  • CISA's KEV entry for CVE-2026-56290 says Joomlack Page Builder has improper access control that could allow remote code execution through unauthenticated arbitrary file upload.
  • CISA's KEV entry for CVE-2026-56291 says Balbooa Forms has unrestricted upload of files with dangerous types that allows unauthenticated arbitrary file upload.
  • CISA's KEV entry for CVE-2026-48939 says iCagenda has unrestricted upload of files with dangerous types that allows upload of arbitrary files.
  • The July 7 KEVs have a July 10, 2026 due date under BOD 26-04; the July 10 additions have a July 17, 2026 due date. Treat the dates as minimum remediation clocks, not as evidence that exploitation is slow or contained.
  • Exploited Joomla extension upload flaws should be treated as likely web-shell exposure until ruled out with logs and file-system review.

Defender heuristics

  1. Inventory internet-facing Joomla sites and confirm whether JoomShaper SP Page Builder, Joomlack Page Builder / Page Builder CK, Balbooa Forms, or iCagenda is installed, including disabled-but-present extension files.
  2. Apply vendor mitigations or fixed versions immediately. If a site cannot be patched, remove the vulnerable extension or take the site out of public reach until remediated.
  3. Hunt web logs for unauthenticated upload requests, extension-specific media/upload endpoints, multipart form submissions, traversal-like filenames, and unexpected requests to newly created .php, .phtml, .phar, or template files.
  4. Review Joomla extension directories, media paths, temporary upload directories, template overrides, and writable cache directories for recently modified executable files.
  5. Preserve access logs, PHP-FPM / Apache / Nginx logs, Joomla logs, and file timestamps before cleanup where exploitation is suspected.
  6. Rotate Joomla administrator credentials, database credentials, SMTP/API secrets, and any application secrets stored in configuration files if a PHP payload may have executed.
  7. Check the compromised site's outbound connections and hosted content for traffic-distribution, phishing-kit, SEO-spam, JavaScript injection, and web-shell callback behavior.

Sources

  • CISA KEV: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
  • JoomShaper SP Page Builder extension listing: https://extensions.joomla.org/extension/sp-page-builder/
  • Joomlack Page Builder CK product page: https://www.joomlack.fr/en/joomla-extensions/page-builder-ck
  • NVD CVE-2026-48908: https://nvd.nist.gov/vuln/detail/CVE-2026-48908
  • NVD CVE-2026-56290: https://nvd.nist.gov/vuln/detail/CVE-2026-56290
  • NVD CVE-2026-56291: https://nvd.nist.gov/vuln/detail/CVE-2026-56291
  • NVD CVE-2026-48939: https://nvd.nist.gov/vuln/detail/CVE-2026-48939