KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2026-56290
9.8
3-Day Required
PoC Available
KEV
Automatable
Active Exploitation
Details
VulnerabilityJoomlack Page Builder Improper Access Control Vulnerability
VendorJoomlack
ProductPage Builder CK
Date added2026-07-07
Due date2026-07-10
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-434
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions
KEV: Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.
NVD: The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
Compliance SSVC + BOD 26-04
Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required
Research metadata
Last researched2026-08-26 00:41 UTC
Searches4
Component defaultno
Sources
https://nvd.nist.gov/vuln/detail/CVE-2026-56290
https://github.com/shinthink/pbck-exploit
https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit
https://github.com/Jenderal92/CVE-2026-56290
https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/
https://www.ionix.io/threat-center/cve-2026-56290/
https://www.sentinelone.com/vulnerability-database/cve-2026-56290/
https://www.redsecuretech.co.uk/blog/post/joomla-page-builder-ck-rce-via-arbitrary-file-upload/1320
https://ccb.belgium.be/advisories/warning-critical-unauthenticated-arbitrary-file-upload-vulnerability-cve-2026-56290
https://github.com/shinthink/pbck-exploit
https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit
https://github.com/Jenderal92/CVE-2026-56290
https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/
https://www.ionix.io/threat-center/cve-2026-56290/
https://www.sentinelone.com/vulnerability-database/cve-2026-56290/
https://www.redsecuretech.co.uk/blog/post/joomla-page-builder-ck-rce-via-arbitrary-file-upload/1320
https://ccb.belgium.be/advisories/warning-critical-unauthenticated-arbitrary-file-upload-vulnerability-cve-2026-56290
Hunting hypothesis agent
Hunt access logs for unauthenticated POSTs to com_pagebuilderck task=browse.ajaxAddPicture or task=fonts.save followed by PHP under /media/com_pagebuilderck/gfonts/; stock logs omit path param so monitor gfonts for new .php files.
Research details
Componentcom_pagebuilderck browse.ajaxAddPicture controller and fonts.save task
PreconditionsNetwork access to a Joomla site running Page Builder CK versions 3.1.1 through 3.5.10; the com_pagebuilderck component must be installed. No authentication required. The CSRF token harvested from any Joomla page has a fixed value of 1 for the token parameter, so CSRF protection is ineffective. Two exploitation paths: (1) browse.ajaxAddPicture with user-controlled path parameter, or (2) fonts.save which pulls a remote font.css triggering a webshell write to /media/com_pagebuilderck/gfonts/. agent
DeliveryTwo paths: (1) Harvest CSRF token from any Joomla page, then POST file upload to index.php?option=com_pagebuilderck&task=browse.ajaxAddPicture&{token}=1 with path parameter set to media/com_pagebuilderck/gfonts/ and file containing a PHP webshell. (2) POST to index.php?option=com_pagebuilderck&task=fonts.save with a remote font.css URL that triggers shell write to media/com_pagebuilderck/gfonts/. Shell accessed via HTTP GET.
Public PoCyes
PoC URLs
https://github.com/shinthink/pbck-exploit
https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit
https://github.com/Jenderal92/CVE-2026-56290 Third-party repos; verify before use.
https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit
https://github.com/Jenderal92/CVE-2026-56290 Third-party repos; verify before use.
Exploit notesPublic PoC available (3 repos: mass exploit, fonts.save scanner, full framework) — significantly lowers barrier to exploitation | CVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | The browse.ajaxAddPicture path parameter undergoes only trim() sanitization with no whitelist, directory traversal check, or authentication gate. The fonts.save path uses a remote font.css callback to trigger shell write.
SummaryJoomlack Page Builder CK (com_pagebuilderck) exposes the browse.ajaxAddPicture controller method which accepts unauthenticated file uploads with a user-controlled destination path. The path parameter undergoes only trim() sanitization, with no directory traversal check or authentication gate. An alternative exploitation path uses the fonts.save task which pulls a remote font.css file, triggering a web shell write to /media/com_pagebuilderck/gfonts/. The CSRF token harvested from any Joomla page has a fixed value of 1, rendering CSRF protection ineffective. Multiple mass-exploitation PoCs are public. Patched in Page Builder CK 3.6.0.
Tia coverage
First reported2026-07-12
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
cisa-kev-two-new-joomla-extension-entries-added-july-10-icagenda
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.