CVE-2026-56290

🗓️ 29 Jun 2026 14:31:37Reported by JoomlaType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 608 Views🌐 WEB

Unauthenticated file upload in Joomla Page Builder CK extension below 3.6.0 enables remote code execution.

Reporter	Title	Published	Views	Family All 26
GithubExploit	Exploit for Improper Access Control in Joomlack Page_Builder_Ck	4 Jul 202600:01	–	githubexploit
GithubExploit	ProofCMS-	29 Sep 202616:18	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Joomlack Page_Builder_Ck	5 Sep 202610:35	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Joomlack Page_Builder_Ck	19 Jul 202608:07	–	githubexploit
GithubExploit	pbck-exploit	14 Jul 202613:06	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Joomlack Page_Builder_Ck	8 Jul 202604:30	–	githubexploit
attackerkb	CVE-2026-56290	29 Jun 202614:31	–	attackerkb
BDU FSTEC	The vulnerability of the browse.ajaxAddPicture method in the PageBuilder CK extension of the Joomla content management system allows a malicious actor to gain unauthorized access to protected information, upload arbitrary files, and execute arbitrary code.	9 Jul 202600:00	–	bdu_fstec
Circl	CVE-2026-56290	29 Jun 202615:38	–	circl
CISA KEV Catalog	Joomlack Page Builder Improper Access Control Vulnerability	7 Jul 202600:00	–	cisa_kev

NVD

Vulners

Node

joomlack page_builder_ckRange<3.6.0joomla!

[
  {
    "defaultStatus": "unaffected",
    "product": "JoomlaCK.fr Page Builder CK extension for Joomla",
    "vendor": "joomlack.fr",
    "versions": [
      {
        "status": "affected",
        "version": "1.0-3.6.0"
      }
    ]
  }
]

Source	Link
joomlack	www.joomlack.fr/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
forum	www.forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3
mysites	www.mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/

Parameter	Position	Path	Description	CWE
option	nested	index.php	Unauthenticated arbitrary file upload via fonts.save in Page Builder CK <= 3.5.10 leading to PHP file write and potential RCE.	CWE-434
task	nested	index.php	Unauthenticated arbitrary file upload via fonts.save in Page Builder CK <= 3.5.10 leading to PHP file write and potential RCE.	CWE-434
token	nested	index.php	Unauthenticated arbitrary file upload via fonts.save in Page Builder CK <= 3.5.10 leading to PHP file write and potential RCE.	CWE-434
local	nested	index.php	Unauthenticated arbitrary file upload via fonts.save in Page Builder CK <= 3.5.10 leading to PHP file write and potential RCE.	CWE-434
fontvars	nested	index.php	Unauthenticated arbitrary file upload via fonts.save in Page Builder CK <= 3.5.10 leading to PHP file write and potential RCE.	CWE-434
fontname	nested	index.php	Unauthenticated arbitrary file upload via fonts.save in Page Builder CK <= 3.5.10 leading to PHP file write and potential RCE.	CWE-434
url	nested	index.php	Unauthenticated arbitrary file upload via fonts.save in Page Builder CK <= 3.5.10 leading to PHP file write and potential RCE.	CWE-434

08 Oct 2026 04:47Current

8.3High risk

Vulners AI Score8.3

CVSS 3.19.8

CVSS 410

EPSS0.30866

SSVC