CVE-2026-56290
published 2026-06-29CVE-2026-56290: Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an…
PriorityP196critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-07-10
Exploited in the wild
EPSS
30.38%
98.2th percentile
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| joomlack.fr | joomlack.fr_page_builder_ck_extension_for_joomla | — | — |
| joomlack | page_builder_ck | < 3.6.0 | 3.6.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthenticated POST requests to the Joomla endpoint `index.php` with query parameters `option=com_pagebuilderck` and `task=fonts.save`. This is the exploitation vector for the arbitrary file upload leading to RCE. ↗
- →The exploit posts a `url` parameter pointing to an attacker-controlled callback server (e.g., for font.css delivery). Detect outbound or inbound requests referencing a `CALLBACK` host combined with `font.css` path in the `fonts.save` request body. ↗
- →After exploitation, a web shell is written to a predictable path (`SHELL_PATH`) under the Joomla web root. Monitor for new PHP file creation under the `com_pagebuilderck` component directory and unexpected HTTP 200 responses to PHP files in that path. ↗
- →The exploit checks for the string `ERROR_INVALID_CONTROLLER` in the server response to determine if the component is present. Absence of this string on a `fonts.save` POST indicates a potentially vulnerable and exploitable target. ↗
- →Use the Google dork `inurl:com_pagebuilderck` or presence of `/components/com_pagebuilderck/assets/pagebuilderck.js` to identify exposed Joomla instances running the vulnerable Page Builder CK component. ↗
- →The exploit sets `Content-Type: application/x-www-form-urlencoded` and `Accept: application/json,text/plain,*/*` on the malicious POST. This combination on requests to `com_pagebuilderck` `fonts.save` is a strong detection signal. ↗
- ·The exploit targets version 3.5.10 specifically in the title, but the NVD and CISA entries do not specify a fixed version. The vendor advisory should be consulted to confirm the exact affected version range and whether a patched release exists. ↗
- ·The `SHELL_PATH` and `CALLBACK` values used by the exploit are runtime variables not hardcoded in the published PoC snippet. The actual dropped shell filename/path will vary per attacker — file integrity monitoring on the entire Joomla web root is recommended rather than relying on a single static path. ↗
- ·CISA has added this to the Known Exploited Vulnerabilities catalog with a remediation due date of 2026-07-10, indicating active in-the-wild exploitation. Treat any unpatched internet-facing Joomla instance with com_pagebuilderck installed as actively at risk. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.010.0CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Joomlack Page Builder Improper Access Control Vulnerability
cisa·2026-07-07·CVSS 9.8
CVE-2026-56290 [CRITICAL] CWE-284 Joomlack Page Builder Improper Access Control Vulnerability
Vulnerability: Joomlack Page Builder Improper Access Control Vulnerability
Affected: Joomlack Page Builder
Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: https://www.joomlac
VulDB
JoomlaCK Page Builder CK Extension 1.0-3.6.0 on Joomla access control (EUVD-2026-40121)
vuldb·2026-07-07·CVSS 9.8
CVE-2026-56290 [CRITICAL] JoomlaCK Page Builder CK Extension 1.0-3.6.0 on Joomla access control (EUVD-2026-40121)
A vulnerability has been found in JoomlaCK Page Builder CK Extension 1.0-3.6.0 on Joomla and classified as critical. This affects an unknown part. This manipulation causes improper access controls.
The identification of this vulnerability is CVE-2026-56290. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
GHSA
The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
ghsa_unreviewed·2026-06-29
CVE-2026-56290 [CRITICAL] CWE-284 The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
VulnCheck
joomlack page_builder_ck Improper Access Control
vulncheck·2026·CVSS 9.8
CVE-2026-56290 [CRITICAL] joomlack page_builder_ck Improper Access Control
joomlack page_builder_ck Improper Access Control
The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
Affected: joomlack.fr JoomlaCK.fr Page Builder CK extension for Joomla
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/
No detection rules found.
Exploit-DB
Joomla Page Builder CK 3.5.10 - Arbitrary File Upload
exploitdb·2026-07-08·CVSS 9.8
CVE-2026-56290 [CRITICAL] Joomla Page Builder CK 3.5.10 - Arbitrary File Upload
Joomla Page Builder CK 3.5.10 - Arbitrary File Upload
---
# Exploit Title: Joomla Page Builder CK 3.5.10 - Arbitrary File Upload
# Google Dork: inurl:com_pagebuilderck OR "/components/com_pagebuilderck/assets/pagebuilderck.js"
# Date: 2026-07-04
# Exploit Author: M@rAz Ali
# Credits: Peyman Siyahi, MR.PERSIA
# Vendor Homepage: https://www.joomlack.fr/
# Software Link: https://www.joomlack.fr/en/joomla-extensions/page-builder-ck
# Version: None:
with _PRINT_LOCK:
print(msg, flush=True)
def normalize_url(url: str) -> str:
url = url.strip()
if not url.startswith(("http://", "https://")):
url = "https://" + url
return url.rstrip("/")
def extract_token(html: str) -> str | None:
for pattern in TOKEN_PATTERNS:
match = re.search(pattern, html, re.I)
if match:
return match.group(1)
return Non
Nuclei
Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload
nuclei·CVSS 9.8
CVE-2026-56290 [CRITICAL] Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload
Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload
Joomla Page Builder CK contains an unrestricted file upload vulnerability caused by lack of proper validation, letting unauthenticated attackers upload executable files and achieve remote code execution.
Template:
id: CVE-2026-56290
info:
name: Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload
author: panchiko-p,0x_Akoko
severity: critical
description: |
Joomla Page Builder CK contains an unrestricted file upload vulnerability caused by lack of proper validation, letting unauthenticated attackers upload executable files and achieve remote code execution.
impact: |
Unauthenticated attackers can upload executable files, leading to full remote code execution and complete system compromise.
remediation: |
Upd
2026-06-29
Published
2026-07-07
Added to CISA KEV
Exploited in the wild