by Kastro
Paper/Archive/CVE-2026-56290

CVE-2026-56290

joomlack.fr JoomlaCK.fr Page Builder CK extension for Joomla — Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0

KEV · due 10 JulEPSS 31%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 98.2.982 × 2019.6Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

Affected

ProductAffectedFixed inSource
JoomlaCK.fr Page Builder CK extension for Joomla1.0-3.6.0–CNA

Scores by source

Joomla (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refjoomlack.frwriteupmysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rcepatchforum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290kevcisa.gov/known-exploited-vulnerabilities-catalog