CVE-2026-48909 - Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4

Back Back to CVE browser

CRITICAL

Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4

Published Jun 20, 2026

9.5

CRITICAL

CVSS 4.0

EPSS 4.94%

Description

SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.

Affected products

Vendor Joomshaper.net Product SP LMS extension for Joomla Default
unaffected
- Version
  1.0.0-4.1.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Joomshaper.net

SP LMS extension for Joomla

unaffected

Version	Status	Constraints
1.0.0-4.1.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38108
Advisory
https://www.joomshaper.com/
product

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38108		Advisory
https://www.joomshaper.com/		product

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Joomla

Published Jun 20, 2026

Updated Jun 23, 2026

Reserved May 26, 2026

Link CVE-2026-48909

CISA Vulnrichment

Updated Jun 22, 2026

NVD

Status Deferred

Modified Jun 22, 2026

Link CVE-2026-48909

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-48909

ENISA EUVD

Assigner Joomla

Published Jun 20, 2026

Updated Jun 23, 2026

Exploited since n/a

Link EUVD-2026-38108

EUVD-2026-38108