CVE-2026-56290
Joomlack Page Builder Improper Access Control Vulnerability
Description
CVE-2026-56290 is a critical unrestricted file upload vulnerability in Joomlack's Page Builder CK extension for Joomla that lets unauthenticated attackers upload executable files and achieve full remote code execution (RCE). Because the extension does not properly validate the type of uploaded files, an attacker can plant a web shell or other executable content and run arbitrary code on the server without any credentials. The flaw carries a CVSS score of 9.8 (Critical) and affects Page Builder CK versions before 3.6.0. CISA has added CVE-2026-56290 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation, and public exploit material exists, so any site running an affected Page Builder CK version must remediate immediately.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| joomlack | page builder ck | < 3.6.0 |
References
- https://www.joomlack.fr/(Product)
- https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3(Issue Tracking, Patch)
- https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
This vulnerability arises because Page Builder CK allows files to be uploaded without properly validating, restricting, or handling their type, letting an attacker upload dangerous executable content such as a web shell. In Page Builder CK the weakness manifests through an unauthenticated upload path that accepts executable files, which the web server then runs, resulting in full remote code execution.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2026-56290 is rated Critical with a CVSS 3.1 score of 9.8 because there are no meaningful barriers to exploitation. The vulnerability is remotely exploitable over the network without physical access, it is easy to exploit with no special conditions needed (Attack Complexity Low), it requires no authentication (Privileges Required None), and it needs no user action (User Interaction None). A successful upload of an executable file leads to full RCE: the High confidentiality, integrity, and availability impacts mean an attacker can read sensitive data, modify site content and databases, and take the affected Joomla site offline entirely. Because CISA lists this vulnerability in its KEV catalog, exploitation is confirmed in the wild and the danger is immediate.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-56290 in the wild by adding it to the Known Exploited Vulnerabilities catalog. Public exploit material is available: a reference tagged as an exploit and third-party advisory documenting the unauthenticated file-upload RCE is published via mysites.guru. The EPSS score of roughly 2.9% (85th percentile) places it in the upper tier of exploitation likelihood, and combined with the confirmed KEV listing this is an act-now vulnerability; ransomware use is currently listed as Unknown. Sites running Page Builder CK before 3.6.0 should patch immediately.
Remediation
- Follow CISA's KEV required action: apply mitigations in accordance with vendor instructions, ensure compliance with CISA's BOD 26-04 patching guidance, and discontinue use of the product if mitigations are unavailable. The remediation due date was 2026-07-10.
- Upgrade Page Builder CK to version 3.6.0 or later, as all versions before 3.6.0 are affected.
- As an interim mitigation, restrict access to the upload functionality and the Joomla administrator paths, and deploy WAF rules to block uploads of PHP and other executable file types to the affected endpoint.
- Review web server and upload directory logs for unexpected executable files and suspicious requests to the Page Builder CK upload handler, and hunt for any web shells that may already have been deployed.
- As long-term hardening, enforce a whitelist of allowed file extensions, validate file content by magic bytes rather than extension alone, rename uploaded files to strip executable extensions, and store uploads outside the web root or in a location that cannot execute scripts.
Technical Details
The root cause of CVE-2026-56290 is CWE-434, an unrestricted upload of a file with a dangerous type: Page Builder CK accepts uploaded files without adequately validating or restricting their type, allowing an executable file to be written into a web-accessible directory and executed by the server for full RCE. The attack is delivered over the network (AV:N) with low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N), which is why the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields the 9.8 score for an unchanged scope. Once the malicious file is uploaded and requested, the attacker gains code execution in the context of the web application, explaining the High confidentiality, integrity, and availability impact.
Frequently Asked Questions
Is CVE-2026-56290 being actively exploited?
Yes. CISA has added CVE-2026-56290 to its Known Exploited Vulnerabilities catalog, confirming exploitation in the wild, and public exploit material documenting the unauthenticated file-upload RCE is available. Ransomware association is currently listed as Unknown.
What products are affected by CVE-2026-56290?
The vulnerability affects Joomlack's Page Builder CK extension for Joomla in all versions before 3.6.0. Sites running Page Builder CK should verify their version and upgrade to 3.6.0 or later.
How do I fix CVE-2026-56290?
Upgrade Page Builder CK to version 3.6.0 or later and apply mitigations per the vendor's instructions in line with CISA's KEV guidance. As interim measures, restrict access to the upload functionality, block executable file uploads with WAF rules, and review logs and upload directories for any web shells already deployed.
How severe is CVE-2026-56290?
It is Critical, carrying a CVSS 3.1 score of 9.8. Because it allows unauthenticated remote code execution with no user interaction, sits in the 85th EPSS percentile, and is confirmed as actively exploited in CISA's KEV catalog, it represents one of the most serious risks a web application can face.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.