CVE-2026-48909: JoomShaper SP LMS (com_splms) Joomla Component Insecure Deserialization of Cookie Data
SP LMS (com_splms), a JoomShaper component for Joomla, is affected by CWE-502 deserialization of untrusted data in versions below 4.1.4. The record states that an unauthenticated remote attacker could execute arbitrary code on the server. No confirmed exploitation appears in the sources consulted, and the record provides no fixed version or KEV listing.
Overview
SP LMS (com_splms), a component from JoomShaper for Joomla, deserializes user-controlled cookie data without validation, according to the record. This is classified as CWE-502, Deserialization of Untrusted Data.
Impact
The record states that an unauthenticated remote attacker could execute arbitrary code on the server. The CVSS 4.0 base score of 9.5 (Critical) was provided by the CNA, security@joomla.org, and the vector reflects high impact on confidentiality, integrity and availability of the vulnerable system.
Affected products and versions
- Product: SP LMS (com_splms), by JoomShaper.
- Versions described as affected: earlier than 4.1.4.
The record does not include structured affected version ranges or fixed versions. The threshold stated in the description is the only version information available.
Exploitation status
The CISA KEV catalog entry in the record shows this CVE is not listed. No confirmed exploitation appears in the sources consulted. EPSS data is not present in the record.
Remediation and mitigation
- Identify every SP LMS installation and record its version.
- Treat installations below 4.1.4 as potentially affected and prioritize them according to internet exposure.
- Check the JoomShaper website for official update information and confirm whether a fixed release is available before deploying changes.
- While an update is pending, limit access to the affected component where operationally feasible and review the Joomla extension inventory.
Detection guidance
- Review web server and application logs for unusual, oversized or malformed cookie values reaching the LMS component.
- Monitor for unexpected child processes, file changes or outbound connections originating from the web server account.
- Note that deserialization abuse can occur within a single request and may leave limited traces in standard access logs.
Limitations of the available information
The record does not include a fixed version, a detailed technical root cause, a vendor advisory text, affected version ranges, EPSS, or SSVC data. The title was not provided in the source record. Whether exploitation has occurred in the wild is unknown from the sources consulted.
Frequently asked questions
What is the vulnerability in SP LMS (com_splms)?
According to the record, the component deserializes user-controlled cookie data without validation, which is classified as CWE-502.
Is this CVE confirmed as exploited in the wild?
The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.