Attack Chain

1. An unauthenticated attacker crafts a malicious PHP serialized object payload designed to trigger the object injection gadget chain.
2. The attacker carefully base64-encodes this payload, manipulating it to avoid characters (/, +, =) that would be filtered by Joomla's input sanitizer when transmitted in a cookie.
3. The attacker sends an HTTP GET request to the /index.php?option=com_splms&view=cart endpoint of the vulnerable Joomla instance, including the specially crafted payload within the lmsOrders cookie.
4. The vulnerable com_splms component retrieves the lmsOrders cookie, base64-decodes it, and then unserialize()s the PHP object.
5. During the deserialization process, if the Joomla CMS version is less than 5.2.2, the FormattedtextLogger::__destruct() gadget is triggered, calling File::write() with attacker-controlled data.
6. This action writes an initial PHP loader (containing hex2bin() to write the real payload) to a specified, PHP-writable path on the server (e.g., /tmp/x.php).
7. The attacker then makes a subsequent HTTP GET request to the newly created loader file, causing it to execute and write the full PHP webshell to the same location.
8. Finally, the attacker can interact with the deployed webshell by sending commands via URL parameters (e.g., ?c=id), achieving unauthenticated remote code execution.

Impact

Successful exploitation of CVE-2026-48909 grants unauthenticated remote code execution on the target server. This allows attackers to completely compromise the affected Joomla instance and the underlying server, leading to data exfiltration, website defacement, further network penetration, or the deployment of additional malicious payloads such as ransomware. Organizations running JoomShaper SP LMS versions 4.1.3 or earlier, particularly on Joomla CMS versions prior to 5.2.2, are at severe risk of server compromise and potential business disruption.

Recommendation

• Patch CVE-2026-48909 immediately: Upgrade JoomShaper SP LMS to version 4.1.4 or higher to remediate the PHP Object injection vulnerability.
• Update Joomla CMS: Ensure your core Joomla CMS is updated to version 5.2.2 or higher to mitigate the RCE gadget chain, even if the SP LMS extension cannot be immediately patched.
• Deploy the Sigma rule in this brief to your SIEM and tune for your environment to detect exploitation attempts.
• Enable webserver access logging: Ensure comprehensive logging of HTTP requests, including full URI paths and cookie headers, to aid in detecting and investigating exploitation attempts.