CVE-2026-48909
CriticalPublic exploitSP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.
Published Jun 20, 2026 · Updated Jun 23, 2026 · Also known as EUVD-2026-38108, GHSA-gf8c-xmwj-whrh
Key Facts
Patch immediately- CVE-2026-48909 is a critical-severity vulnerability (CVSS 9.5 v4) affecting SP LMS extension for Joomla.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 4.9% probability of exploitation in the next 30 days.
- No fixed version is listed yet; check the vendor advisory for mitigations.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
CVSS v4
9.5
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS (30-day exploit likelihood)
4.9%
Higher than 92.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-48909 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SP LMS extension for Joomla | >= 1.0.0-4.1.3 | n/a |
Timeline
Publicly disclosed
Jun 20, 2026
Last updated
Jun 23, 2026
Weakness Type
- CWE-502 Deserialization of Untrusted Data
References
- exploitExploitDB-52617
- otherhttps://www.joomshaper.com/
FAQ
Common Questions.
SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.
Affected: SP LMS extension for Joomla versions >= 1.0.0-4.1.3. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-48909 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo