CVE-2026-56290CriticalCVSS 10.0CVE published 29 June 2026

Page Builder CK (com_pagebuilderck) below 3.1.1 - Unauthenticated Arbitrary File Upload (RCE, CVE-2026-56290)

Q: Which versions are affected by CVE-2026-56290?

CVE-2026-56290 is covered by 4 rules: Page Builder CK before 3.1.1; Page Builder CK from 3.4.0 up to but not including 3.4.10; Page Builder CK from 3.5.0 up to but not including 3.6.0; Page Builder CK from 3.6.0 up to but not including 3.6.3.

Q: How do I fix CVE-2026-56290?

It depends on the extension and release line your site runs. For Page Builder CK before 3.1.1: update Page Builder CK to 3.1.1 for this flaw, or to 3.6.5 or later, which no rule we check matches. For Page Builder CK from 3.4.0 up to but not including 3.4.10: update Page Builder CK to 3.4.10 for this flaw, or to 3.6.5 or later, which no rule we check matches. For Page Builder CK from 3.5.0 up to but not including 3.6.0: update Page Builder CK to 3.6.0 for this flaw, or to 3.6.5 or later, which no rule we check matches. For Page Builder CK from 3.6.0 up to but not including 3.6.3: update Page Builder CK to 3.6.3 for this flaw, or to 3.6.5 or later, which no rule we check matches.

Q: How severe is CVE-2026-56290?

Joomla CNA scores it 10.0 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.

Page Builder CK is affected by a critical unauthenticated arbitrary file upload that leads to remote code execution. The front-end browse.ajaxAddPicture task is gated only by an anti-CSRF token (freely readable by any visitor) with no authorisation check, no extension allow-list and no path confinement, so a guest can upload any file - including a .php web shell - to any folder, and path traversal can even write outside the web root. Both the free and Pro editions are affected on Joomla 3, 4, 5 and 6. The developer has released secured back-branch builds: update to 3.1.1+ (Joomla 3 line), 3.4.10+ (Joomla 4 line) or 3.6.3+ (Joomla 5/6 line) via the Joomla Update Manager. On the Joomla 5/6 line do not stop at 3.6.0-3.6.2: those builds closed the anonymous path but left the upload file-type allow-list disabled, so any Editor-level account could still upload and run PHP (CVE-2026-63048); 3.6.3 restores the allow-list. Because the upload can land anywhere, audit the whole site (not just /images) for unexpected .php files. The unauthenticated flaw is tracked as CVE-2026-56290 (CVSS 10.0).

Is my site affected?

CVE-2026-56290 is checked by 4 rules. Find the extension and release line your site runs:

Extension	Affected versions	Fixed in	What to do
Page Builder CK	before 3.1.1	3.1.1	Update Page Builder CK to 3.1.1 for this flaw, or to 3.6.5 or later, which no rule we check matches.
Page Builder CK	from 3.4.0 up to but not including 3.4.10	3.4.10	Update Page Builder CK to 3.4.10 for this flaw, or to 3.6.5 or later, which no rule we check matches.
Page Builder CK	from 3.5.0 up to but not including 3.6.0	3.6.0	Update Page Builder CK to 3.6.0 for this flaw, or to 3.6.5 or later, which no rule we check matches.
Page Builder CK	from 3.6.0 up to but not including 3.6.3	3.6.3	Update Page Builder CK to 3.6.3 for this flaw, or to 3.6.5 or later, which no rule we check matches.

Check whether your sites are affected

How CVE-2026-56290 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

10.0 Critical

CVSS 4.0, scored by Joomla CNA

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red

How it is reached

AV:N Attack vector: Network. Reachable across the internet
AC:L Attack complexity: Low. Nothing to work around, it just works
AT:N Attack requirements: None. Works against any affected install
PR:N Privileges required: None. No account needed
UI:N User interaction: None. Nobody has to be tricked into anything

What it does to the site

VC:H Confidentiality: High. Everything the site holds can be read
VI:H Integrity: High. Data and files can be altered at will
VA:H Availability: High. The site can be taken down

What it does beyond the site

SC:H Confidentiality: High. Data on other systems can be read
SI:H Integrity: High. Other systems can be altered
SA:H Availability: High. Other systems can be taken down

Timeline

27 June 2026We published: PageBuilder CK File Upload RCE - June 2026
29 June 2026CVE-2026-56290 record published by its CNA
21 July 2026We published: PageBuilder CK RCE fixed - again - correctly this time

Rule details

CriticalCVE-2026-56290

Page Builder CK

Affected versions: < 3.1.1

Full advisory: our disclosure post

CriticalCVE-2026-56290

Page Builder CK - Page Builder CK (com_pagebuilderck) 3.4.0 to 3.4.9 - Unauthenticated Arbitrary File Upload (RCE, CVE-2026-56290)

Affected versions: ≥ 3.4.0 and < 3.4.10

Full advisory: our disclosure post

CriticalCVE-2026-56290

Page Builder CK - Page Builder CK (com_pagebuilderck) 3.5.0 to 3.5.x - Unauthenticated Arbitrary File Upload (RCE, CVE-2026-56290)

Affected versions: ≥ 3.5.0 and < 3.6.0

Full advisory: our disclosure post

CVE-2026-63048 CVE-2026-56290

Page Builder CK - Page Builder CK (com_pagebuilderck) 3.6.0 to 3.6.2 - Authenticated Arbitrary File Upload (RCE, CVE-2026-63048), incomplete fix of CVE-2026-56290

The 3.6.0 fix for the critical unauthenticated file upload (CVE-2026-56290) added an access/core.edit gate at the front-end entry point but did not correct the upload handler itself: the file-extension allow-list in helpers/ckbrowse.php remained commented out through 3.6.2. Any authenticated account with core.edit (the default Editor group) could therefore still upload an attacker-named file, including .php, to a web-served folder via the front-end browse.ajaxAddPicture task and execute it - an authenticated arbitrary file upload to remote code execution, a privilege escalation from content editor to full site compromise. Assigned CVE-2026-63048 via the Joomla CNA on 22 July 2026 as the authenticated variant / incomplete fix of CVE-2026-56290. Fixed in 3.6.3, which restores the file-type allow-list (component allow-list plus Joomla core MediaHelper::canUpload) while keeping the access gate and CSRF token. Update to 3.6.3 or later. As defence in depth, block PHP execution in writable directories, and if untrusted Editor accounts exist audit for unexpected .php files.

Affected versions: ≥ 3.6.0 and < 3.6.3

Full advisory: our disclosure post

Our disclosure posts

PageBuilder CK File Upload RCE - June 2026

PageBuilder CK below 3.6.0 lets anyone upload and run a file on your Joomla site, no login. CVE-2026-56290, CVSS 10.0, exploited in the wild. Update to 3.6.0.

27 Jun 2026

PageBuilder CK RCE fixed - again - correctly this time

PageBuilder CK's 3.6.0 fix for its file-upload RCE (CVE-2026-56290) added just a login check; any Editor could still run code. Fixed in 3.6.3. Be on 3.6.5.

21 Jul 2026

Other vulnerabilities in Page Builder CK

Updating for CVE-2026-56290 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

Page Builder CK

Latest safe version: 3.6.5

CVE-2026-63048 Critical, from 3.1.1 up to but not including 3.1.4
CVE-2026-74254 Critical, from 3.6.3 up to but not including 3.6.4
CVE-2026-77993 High, from 3.6.4 up to but not including 3.6.5
CVE-2026-77994 High, from 3.6.4 up to but not including 3.6.5
CVE-2026-62414 Medium, from 3.6.0 up to and including 3.6.1

References

CVE-2026-56290 questions

Which versions are affected by CVE-2026-56290?

CVE-2026-56290 is covered by 4 rules: Page Builder CK before 3.1.1; Page Builder CK from 3.4.0 up to but not including 3.4.10; Page Builder CK from 3.5.0 up to but not including 3.6.0; Page Builder CK from 3.6.0 up to but not including 3.6.3.

How do I fix CVE-2026-56290?

It depends on the extension and release line your site runs. For Page Builder CK before 3.1.1: update Page Builder CK to 3.1.1 for this flaw, or to 3.6.5 or later, which no rule we check matches. For Page Builder CK from 3.4.0 up to but not including 3.4.10: update Page Builder CK to 3.4.10 for this flaw, or to 3.6.5 or later, which no rule we check matches. For Page Builder CK from 3.5.0 up to but not including 3.6.0: update Page Builder CK to 3.6.0 for this flaw, or to 3.6.5 or later, which no rule we check matches. For Page Builder CK from 3.6.0 up to but not including 3.6.3: update Page Builder CK to 3.6.3 for this flaw, or to 3.6.5 or later, which no rule we check matches.

How severe is CVE-2026-56290?

Joomla CNA scores it 10.0 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

Rules current as of 8 October 2026.