Unauthenticated remote code execution flaws in Joomla and Langflow added to CISA KEV catalog

Summary

CISA has updated its KEV catalog to include three high-severity vulnerabilities currently being exploited by threat actors. The flaws impact popular Joomla extensions, including SP Page Builder and Page Builder CK, as well as the Langflow AI agent deployment tool.

The vulnerabilities allow attackers to bypass access controls to execute arbitrary code or manipulate user workflows. Because these flaws are actively being used in attacks, CISA's Binding Operational Directive (BOD) 26-04 requires federal agencies to prioritize rapid remediation for these specific assets.

Technical Details

Joomla Extension Exploitation

Two separate vulnerabilities in Joomla page builder extensions allow unauthenticated attackers to achieve full remote code execution (RCE).

• CVE-2026-48908: Affects JoomShaper's SP Page Builder. The flaw allows an unauthenticated user to upload arbitrary files of a dangerous type, which can then be executed as PHP code on the server.
• CVE-2026-56290: Affects JoomlaCK's Page Builder CK extension. This vulnerability involves improper access control that permits unauthenticated arbitrary file uploads, leading to full RCE.

Langflow Authorization Bypass

The Langflow AI tool contains an Insecure Direct Object Reference (IDOR) vulnerability in its /api/v1/responses endpoint.

An authenticated attacker can execute any flow belonging to another user by specifying the victim's unique flow_id (UUID) in a request. This allows access to potentially sensitive data processed within those flows. The flaw exists because the system queries the database for the requested UUID without verifying if the authenticated user owns that specific flow.

Proof of Concept

An attacker can execute a victim's flow by sending a POST request containing the target flow_id in the model field. A working proof-of-concept is published at https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2

POST /api/v1/responses HTTP/1.1
Host: localhost:7860
x-api-key: sk-ATTACKER_API_KEY
Content-Type: application/json

{
  "model": "VICTIM_FLOW_ID",
  "input_value": "test",
  "stream": false
}

Affected Products and Fixed Versions

Defender Guidance

Immediate Remediation

• Update Langflow: Upgrade all Langflow instances to version 1.9.2 or later immediately to close the IDOR vulnerability.
• Patch Joomla Extensions: Check for updates from JoomShaper and JoomlaCK regarding their respective Page Builder extensions. If official patches are not yet available, consider disabling these extensions on publicly exposed assets until a fix is applied.

Risk-Based Management Under CISA's BOD 26-04, organizations should treat these vulnerabilities as high priority because they grant total control of the asset post-exploitation. Verify whether your systems were compromised before applying patches by checking for unauthorized file uploads or unexpected flow executions in Langflow logs.