Staff replied General Locked

𝐒𝐏 𝐏𝐚𝐠𝐞 𝐁𝐮𝐢𝐥𝐝𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐏𝐚𝐭𝐜𝐡 𝐚𝐧𝐝 𝐌𝐚𝐧𝐮𝐚𝐥 𝐅𝐢𝐱 𝐃𝐞𝐭𝐚𝐢𝐥𝐬

Asked by Toufiq 3 months ago Last activity 3 months ago

Following our previous security announcement for SP Page Builder v6.6.2, we’re sharing the exact patch details for users who need to review or apply the fix manually.

These changes fully secure the affected controller endpoint.

Affected file:

components/com_sppagebuilder/controllers/asset.php

Download & replace the patch file:

https://gist.github.com/ahamed/b45bd9605d81064b1f1a751ee23e4bd4

We still strongly recommend updating to the latest SP Page Builder version instead of manually replacing files.

Go to:

System -> Update -> Extensions

If you are already using SP Page Builder v6.6.2 or later, no further action is required.

Thank you for keeping your Joomla websites safe. 🙌

16 replies

Chriss

3 months ago

WOW, ONE WEEK LATER!

Ofi Khan Staff

3 months ago

Hello Chriss

Apology for the delay. We heard your voice and felt the necessity for a free patch. If you have an active SP Page Builder subscription, then you need to update the version to 6.6.2. No further action needed.

If you do not have a subscription, only then use the patch. Just the change the file contents of components/com_sppagebuilder/controllers/asset.php and the site will be safe again.

Thanks for keeping your trust in us.

Best regards

David Forés

3 months ago

Just to clarify, when you say that “no further action is needed,” you should specify that this applies only if the website hasn’t been hacked. In that case, it’s true that simply updating the version would be enough.

But if the site has been hacked, no matter how much you update SP Page Builder, the attackers already have complete control over your site and have likely left several hidden backdoors through which they can re-enter. In this case, there is indeed a LOT of work to be done.

Toufiq Senior Staff

3 months ago

Thank you for pointing this out. You are right, we should clarify that no further action is needed applies only to websites that were not compromised and have simply updated to the patched version.

If a website was already compromised before applying the update, additional security checks are required, as updating only fixes the vulnerability but does not automatically remove any existing malicious files or changes.

We appreciate your clarification and will make sure our communication is clearer on this point.

Chriss

3 months ago

“Thanks for continuing to trust us.”

No, you've lost that trust. Once again, your help is way too late! The honest answer would have been to delete everything, restore the backup, and buy the update. Don't just slap a file together a week later! Sticking with SP PageBuilder is a mistake!

Toufiq Senior Staff

3 months ago

We’re really sorry for the frustration and inconvenience this has caused. We understand your concern, and this is not the experience we want you to have.

The fix was already included in the v6.2.2 patch release. The file we shared separately is the same fixed file for users who need a quick manual solution without going through the full update process.

We truly appreciate your patience and feedback. We’ll continue working to improve our release and support process.

Anke Sauer

3 months ago

Yes, I have to agree with that.
I’m now dealing with a huge mess across many of my clients’ websites. And as is often the case with clients, they didn’t necessarily back up their data after their last updates.
I can’t even bill them for my work while I’m sitting here trying to get everything back on track.
This really shouldn’t happen—after all, they’re putting a lot of money into this, not to mention their trust.
My clients trust me, too, and now I have to explain to them why the sites aren’t working anymore. That’s it, then.
Thanks a lot for that.

Chriss

3 months ago

I can only recommend rebuilding your website and uninstalling SP PageBuilder as soon as possible. I’ve taken down 6 sites so far, and as you can see here, the effort has totally paid off. The last two are going down now!

Toufiq Senior Staff

3 months ago

We sincerely apologize for the trouble and frustration this has caused. We understand how difficult this situation is when managing multiple client websites, and we truly regret the inconvenience.

The fix has already been included in the v6.2.2 patch update. We also shared the specific fixed file separately to help affected users resolve the issue faster.

If any websites are still having issues, please share the details with us. Our team will do our best to help you get everything back on track.

Thank you for your feedback. We take this seriously and will continue improving our release process.

ANT

3 months ago · edited

Thanks for all.
I have an old j3 and sppb 3.8.10 (I know)
is this normal that asset.php does not exist ?

Toufiq Senior Staff

3 months ago

If you are using Page Builder 3, you don’t need to worry about this security update.

ANT

3 months ago

the mail sent today was about joomla 3 and sppb3

Paul Frankowski Senior Staff

3 months ago

@Ant, answer is already here: https://www.joomshaper.com/forum/question/45163

Mike Lawson

3 months ago

Figured Id take a break from fixing my client's hacked websites and chime in on the matter.

Ever considered offering credits to your loyal subscribers? Constantly apologizing over and over is more insulting than it is comforting.

Paul Frankowski Senior Staff

3 months ago

@Chris, not really! This is free path for webmasters without active SPPB subsctiption.

And as you may know, not all developers do that.

Paul Frankowski Senior Staff

3 months ago · edited

It was general info that you are using old versions on your own risk. We don't update and improve extensions for J3 anymore.

Paul Frankowski Senior Staff

3 months ago · edited

What do you mean saying "credits" ? as I know every software had or will have security holes. Even big ones from Top 100, Windows or Android included!. In this comparison, we are a small "player". And the Joomla market share is only getting smaller every year, not growing :/ Such security problems, therefore, are painful for both sides. Believe me, I'd rather answer the question “How do I change the button color?” 100 times than read about a website being hacked—whether it's because of us or for some other reason.

@Mike, We talk about that face-to-face on Joomla Day 2026, if you will be there.

Mike Lawson

3 months ago

Credits as in crediting money people pay you for using your product that is completely compromised.
Ive never encountered a Joomla plugin or component with such a gaping security flaw..until now.

Anyways, any idea how I can stop my website from being hacked?? Something is hacking my root folder and adding .html files and folders...and erasing my .htaccess file. I have V6.6.2 installed and Im still getting hacked!

Ahmad Moussa

3 months ago

Hello Toufiq, please is this applied on SP Page Builder 3 on Joomla 3 site?

martin

3 months ago

that’s a good question

Paul Frankowski Senior Staff

3 months ago · edited

SPPB 3.8.10 don't have upload custom Icon feature, so found SPPB security problem don't effect 3.x version. Full answer is already here: https://www.joomshaper.com/forum/question/45163
and also here in the middle: https://www.joomshaper.com/forum/question/45152

@Ahmad, @Martin, @Ant, @Indi

Ahmad Moussa

3 months ago

Thank you Paul for the information.

Paul Frankowski Senior Staff

3 months ago · edited

@Mike

For example, serious vulnerabilities are regularly discovered in the MS Office suite. The last 5 years (the period from 2021 to 2026) have been a time when Microsoft had to deal with both so-called zero-days (vulnerabilities actively exploited by hackers before a patch is released) and a wave of clever bypasses of existing security measures. But somehow I don't recall Microsoft giving users anything in return to customers for their losses. Except, at most, price hikes for subsequent versions.

Check main topic (https://www.joomshaper.com/forum/question/45152) where we all (as community) add many useful tips every single day to help each other. If your infection returns it means that there is hidden a file on your server that allows that. Read what @Yves Lacroix wrote today, at the bottom (from shared link).

point

3 months ago

Hello,

after the recent security announcement regarding SP Page Builder v6.6.2 and the affected file:

components/com_sppagebuilder/controllers/asset.php

I checked several of our Joomla websites that use SP Page Builder.

The only installation where I found this file was the one running SP Page Builder v3.7.14. On that website, the file existed at the mentioned path, so I replaced it with the patched version from the provided GitHub gist.

On the other SP Page Builder installations I checked, using different 3.x versions, this file does not exist at all.

My questions are:

Is this security issue only related to SP Page Builder v6.6.2 and later, or can it also affect older SP Page Builder 3.x versions?
If the file components/com_sppagebuilder/controllers/asset.php does not exist on a website, does that mean the website is not affected by this specific vulnerability?
Should we manually add this patched file to older installations where the file does not exist, or should the patch only be applied if the file is already present?
Since I found the file only on the installation running v3.7.14, does that version require the patch?
For websites running older SP Page Builder 3.x versions, is updating to the latest available 3.x version enough, or is there a separate security fix required?

We manage multiple Joomla websites using SP Page Builder and want to make sure all of them are properly secured.

Thank you.

Paul Frankowski Senior Staff

3 months ago · edited

@Point.

Let's be serious, using version 3.7 from Sep 2021, 5 years later is not the best idea. You should have at least SPPB v3.8.10 (may 2023) and firewall installed (anyway). Why you couldn't update it sooner?

Yes. The fix we shared was for SPPB 5.x and SPPB 6.6.x only. In 6.6.2+ is already fixed.
No
Look (1)
SPPB Pro 3.8.10 can still be downloaded from our website, please use it to update site(s).
Scroll up, what I wrote yesterday here about SPPB 3.8.10. In general, yes.

If you have any other questions, feel free to ask.

Ask your hosting support: Does your server have account (website) isolation in place so that an infected site does not act as a gateway to another site on the same account?

Paul Frankowski Senior Staff

3 months ago · edited

IMPORTANT, READ BEFORE POSTING // IMPORTANTE: LÉELO ANTES DE PUBLICAR // WICHTIG – BITTE VOR DEM POSTEN LESEN // IMPORTANT, À LIRE AVANT DE PUBLIER

The above fix file is only for SP Page Builder 5.x-6.6.1, if you still have SPPB 4.x or SPPB 3.x is not for you!

If you updated to SPPB 6.6.2+ you have it already.

Petra

3 months ago

Hi guys,

I installed 6.6.2 on a new site with Joomla 6.1.1 and template selixo (just template installation over fresh Joomla!) and when I want to use the articles addon, there is no way to select the category. Can you please check on your side and advise how to fix it? I tried installing 6.6.1 over it, but it did not help.

Paul Frankowski Senior Staff

3 months ago · edited

@Petra, this topic is/was only about security !!!

Yes, we know about that issue. It will be fixed in next update.

Temporary it can be fixed by using file from older SPPB version. Here is short guide, next time NEW TOPIC !!!

Download any new quickstart (Kind or Nexio or older) and take this file:
components\com_sppagebuilder\addons\articles\admin.php

use older SPPB 6.6.0 and take this file from it:
site\addons\articles\admin.php

Then using FTP upload & override that file: components\com_sppagebuilder\addons\articles\admin.php

that's all! you're welcome.

This question is locked, so it takes no new replies. Have a similar problem? Ask a new question.