---
id: CVE-2026-81564
title: >-
  Joomla Extension - joomshaper.com - Missing Directory Confinement in Media
  Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0
  - 6.9.0 - The media rename task applied neither of the directory boundary
  checks use…
summary: >-
  Joomla Extension - joomshaper.com - Missing Directory Confinement in Media
  Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0
  - 6.9.0 - The media rename task applied neither of the directory boundary
  checks use…
severity: high
cvss: 7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L'
cwe:
  - CWE-22
vendor: joomshaper.com
product: SP Page Builder (Free and Pro) extension for Joomla
affected:
  - sp_page_builder_free_and_pro_extension_for_joomla 4.0.0 - 6.9.0
published: '2026-09-14'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T19:28:06.713'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81564'
references:
  - url: 'https://www.joomshaper.com/joomla-extensions/sp-page-builder-pro'
    label: security@joomla.org
tags:
  - nvd
  - cve.org
epss: 0.00468
epssPercentile: 0.37792
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T14:25:59.864804Z'
cvssSource: cna
ingestedAt: '2026-09-14T15:23:07.421Z'
---

## Overview

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The media rename task applied neither of the directory boundary checks used by the folder operations in the same controller, and its validation guard required only that either a media record exist for the supplied identifier or that the supplied path be present in #__spmedia, rather than both. The identifier and the path were consequently never checked against one another, so any valid media identifier could be paired with an unrelated filesystem path, and the STR input filter left traversal sequences intact. An attacker could rename files elsewhere in the installation, including renaming configuration.php to take the site offline.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.