Joomla Page Builder CK flaw allows full site takeover

Published July 7, 2026 CVE-2026-56290

A flaw in Joomla's Page Builder CK extension lets attackers upload files to your site and run their own code, taking full control of it. JoomlaCK and Joomlack Page Builder users must update immediately.

Severity
CriticalCVSS 3.1 ยท 9.8
Fix
Fixed in 3.6.0Fix recorded on Aug 26, 2026
Affected versions
1.0-3.6
Weakness
CWE-434Unrestricted Upload of Dangerous File Type
Exploit likelihood
30% in 30 daysEPSS, higher than 98% of known flaws
Affects
JoomlaCK.fr Page Builder CK extension for Joomla
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Jul 7, 2026
Federal fix deadline
Jul 10, 2026

How it works

An attacker sends a fake file upload request to the Joomla Page Builder CK extension, which saves the file without checking who sent it.

What to do

Check whether the installed Page Builder CK version is older than 3.6.0.

Update Page Builder CK to 3.6.0 or newer. Then verify the installed version.

Technical details

Affected software: JoomlaCK.fr Page Builder CK extension for Joomlaby joomlack.fr

CVE-2026-56290 is an unauthenticated arbitrary file upload (CWE-434) caused by improper access control (CWE-284) in the Page Builder CK Joomla extension before 3.6.0. The upload endpoint accepts requests with no authentication and no file-type restriction, so an attacker can place an executable script (such as a PHP file) in a web-accessible location and then request it directly to achieve remote code execution on the underlying server. EPSS exploit probability is currently low (0.276 percent), but the flaw is listed in VulnCheck's Known Exploited Vulnerabilities feed and carries a high severity rating given the unauthenticated full-RCE impact.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator
View Original Source