The flaw in SP Page Builder arises from improper path validation combined with insufficient access control checks. An authenticated Joomla user can leverage the media manager to delete arbitrary files on the server, potentially removing critical site assets or configuration files. This type of misuse directly leads to loss of data integrity and availability. The weakness aligns with CWE‑22: Improper Limitation of Pathname Manipulation.

The vulnerability affects the SP Page Builder extension for Joomla released by joomshaper.com. Versions of the extension older than 6.7.1 are susceptible; any Joomla installation deploying these versions is at risk.

With a CVSS score of 8.3, the problem is considered high severity. The EPSS score is 0.00325, indicating a very low but non-zero probability of exploitation, and the issue is not listed in the CISA KEV catalog. The attack vector requires an authenticated user with sufficient privileges in Joomla, as the exploit depends on using the media manager functionalities. If such an attacker can elevate a user’s permissions to allow deletion, any file in the web server’s document root may be removed.