Vulnerability Description
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Joomlack | Page Builder Ck | < 3.6.0 |
Related Weaknesses (CWE)
References
- https://www.joomlack.fr/Product
- https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbIssue TrackingPatch
- https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-US Government Resource
FAQ
What is CVE-2026-56290?
CVE-2026-56290 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that ...
How severe is CVE-2026-56290?
CVE-2026-56290 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-56290?
Check the references section above for vendor advisories and patch information. Affected products include: Joomlack Page Builder Ck.