CVE-2026-56290criticalunder attackCWE-434

CVE-2026-56290: critical vulnerability in JoomlaCK.fr Page Builder CK extension for Joomla

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0

Published · Updated

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 10epss 31%
from disclosure to weapon4 days
Published on NVDJun 29
1st PoC+4d
CISA KEV+8d
exploitation probability
31%top 2% of all CVEs
observed exploitation
yesCISA + VulnCheck
9 public exploit(s)
Action required by CISAfederal deadline: 2026-07-10

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

The Page Builder CK extension for Joomla allows anyone to upload files without logging in, including dangerous executable files that can take over the entire website. This is a critical security flaw that requires immediate patching.

Technical detail

CWE-434 unrestricted file upload vulnerability in Page Builder CK < 3.6.0 permits unauthenticated attackers to upload arbitrary executable files via unprotected endpoints, leading to remote code execution with full server compromise. No authentication or special privileges are required to exploit this flaw.

Summary generated and translated by AI from the official description.
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
Affected products
joomlack.fr · JoomlaCK.fr Page Builder CK extension for Joomla
public PoCs found — 9
exploitdbwww.exploit-db.com/exploits/52626unverifiedgithubgithub.com/Jenderal92/CVE-2026-56290★ 5githubgithub.com/shinthink/pbck-exploit★ 3githubgithub.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit★ 2githubgithub.com/ChiefYoru/CVE-2026-56290_PoC★ 0githubgithub.com/katranSefa/CVE-2026-56290★ 0vulncheckvulncheck.com/xdb/0729778835c6unverifiedvulncheckvulncheck.com/xdb/1e34893b8b9aunverifiedvulncheckvulncheck.com/xdb/8d90489e52a0unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290https://www.joomlack.fr/