CVE-2026-56290: Joomla Page Builder CK unauthenticated file upload leads to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable file upload leading to full RCE, with a CVSS 4.0 score of 10, CISA KEV listing, and high EPSS probability.

What it is

The Joomla Page Builder CK extension before 3.6.0 allows unauthenticated arbitrary file uploads, letting an attacker place executable files on the server. Because the uploaded files can be executed, this escalates directly to full remote code execution on the affected Joomla site.

Impact

An unauthenticated attacker can upload and execute arbitrary code, gaining full control of the Joomla web server and its data. This can lead to site defacement, data theft, and use of the host as a foothold for further compromise.

Attack surface

The flaw is reachable over the network through the extension's file upload functionality with no authentication and no user interaction required, per the CVSS vector (AV:N/PR:N/UI:N). Any internet-exposed Joomla site running the vulnerable extension is directly reachable.

Exploitation

CVE-2026-56290 is listed in CISA KEV with a due date of 2026-07-10, and EPSS shows a 30-day probability of 0.30375 (98th percentile), indicating active exploitation is expected or observed. A public exploit write-up is referenced, and no ransomware use is documented.

What to do

• Update Page Builder CK to version 3.6.0 or later immediately, per the vendor patch reference.
• If patching is not possible, disable or remove the Page Builder CK extension until it can be updated.
• Apply CISA BOD 26-04 required actions and evaluate internet exposure of all Joomla assets running this extension.
• Restrict or block access to the extension's upload endpoints at the web server or WAF until remediation is complete.
• Audit the Joomla installation for unexpected files or web shells after any suspected exposure.

Detection

• Monitor web server logs for POST requests to Page Builder CK upload endpoints, especially from unauthenticated clients.
• Alert on newly created executable files (for example .php) in Joomla upload, media, or extension directories.
• Hunt for anomalous outbound connections or process execution originating from the web server after upload activity.
• Review file integrity monitoring alerts for unexpected changes under the Joomla web root.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.