CVE catalog
CVE-2026-56290
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that
- Severity
- Critical · CVSS 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red - Published
- Source
- [NVD] · [CVE record]
- Exploitation
- CISA Known Exploited Vulnerabilities
- EPSS
- 30.87% · Oct 25, 2026
Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | page_builder_ck | Not reported | 3.6.0 | fixed |
| Cpe | page_builder_ck | Not reported | 3.6.0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | page_builder_ck | cpe | Not reported | 3.6.0 | Not reported | Not reported | Not reported |
| Cpe | page_builder_ck | cpe | Not reported | 3.6.0 | Not reported | NVD-CVE-2026-56290 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3]
- [https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-56290]
- [https://www.cisa.gov/known-exploited-vulnerabilities-catalog]
- [https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290]
- [https://www.joomlack.fr/]
[CISA Known Exploited Vulnerabilities (OSINT)] · [FIRST EPSS] · [National Vulnerability Database (NVD)]