Page Builder CK (com_pagebuilderck) below 3.1.1 - Unauthenticated Arbitrary File Upload (RCE, CVE-2026-56290)

Page Builder CK

Affected versions: < 3.1.1

Full advisory: our disclosure post

Page Builder CK - Page Builder CK (com_pagebuilderck) 3.4.0 to 3.4.9 - Unauthenticated Arbitrary File Upload (RCE, CVE-2026-56290)

Page Builder CK is affected by a critical unauthenticated arbitrary file upload that leads to remote code execution. The front-end browse.ajaxAddPicture task is gated only by an anti-CSRF token (freely readable by any visitor) with no authorisation check, no extension allow-list and no path confinement, so a guest can upload any file - including a .php web shell - to any folder, and path traversal can even write outside the web root. Both the free and Pro editions are affected on Joomla 3, 4, 5 and 6. The developer has released secured back-branch builds: update to 3.1.1+ (Joomla 3 line), 3.4.10+ (Joomla 4 line) or 3.6.3+ (Joomla 5/6 line) via the Joomla Update Manager. On the Joomla 5/6 line do not stop at 3.6.0-3.6.2: those builds closed the anonymous path but left the upload file-type allow-list disabled, so any Editor-level account could still upload and run PHP (CVE-2026-63048); 3.6.3 restores the allow-list. Because the upload can land anywhere, audit the whole site (not just /images) for unexpected .php files. The unauthenticated flaw is tracked as CVE-2026-56290 (CVSS 10.0).

Affected versions: ≥ 3.4.0 and < 3.4.10

Full advisory: our disclosure post

Page Builder CK - Page Builder CK (com_pagebuilderck) 3.5.0 to 3.5.x - Unauthenticated Arbitrary File Upload (RCE, CVE-2026-56290)

Page Builder CK is affected by a critical unauthenticated arbitrary file upload that leads to remote code execution. The front-end browse.ajaxAddPicture task is gated only by an anti-CSRF token (freely readable by any visitor) with no authorisation check, no extension allow-list and no path confinement, so a guest can upload any file - including a .php web shell - to any folder, and path traversal can even write outside the web root. Both the free and Pro editions are affected on Joomla 3, 4, 5 and 6. The developer has released secured back-branch builds: update to 3.1.1+ (Joomla 3 line), 3.4.10+ (Joomla 4 line) or 3.6.3+ (Joomla 5/6 line) via the Joomla Update Manager. On the Joomla 5/6 line do not stop at 3.6.0-3.6.2: those builds closed the anonymous path but left the upload file-type allow-list disabled, so any Editor-level account could still upload and run PHP (CVE-2026-63048); 3.6.3 restores the allow-list. Because the upload can land anywhere, audit the whole site (not just /images) for unexpected .php files. The unauthenticated flaw is tracked as CVE-2026-56290 (CVSS 10.0).

Affected versions: ≥ 3.5.0 and < 3.6.0

Full advisory: our disclosure post

Page Builder CK - Page Builder CK (com_pagebuilderck) 3.6.0 to 3.6.2 - Authenticated Arbitrary File Upload (RCE, CVE-2026-63048), incomplete fix of CVE-2026-56290

The 3.6.0 fix for the critical unauthenticated file upload (CVE-2026-56290) added an access/core.edit gate at the front-end entry point but did not correct the upload handler itself: the file-extension allow-list in helpers/ckbrowse.php remained commented out through 3.6.2. Any authenticated account with core.edit (the default Editor group) could therefore still upload an attacker-named file, including .php, to a web-served folder via the front-end browse.ajaxAddPicture task and execute it - an authenticated arbitrary file upload to remote code execution, a privilege escalation from content editor to full site compromise. Assigned CVE-2026-63048 via the Joomla CNA on 22 July 2026 as the authenticated variant / incomplete fix of CVE-2026-56290. Fixed in 3.6.3, which restores the file-type allow-list (component allow-list plus Joomla core MediaHelper::canUpload) while keeping the access gate and CSRF token. Update to 3.6.3 or later. As defence in depth, block PHP execution in writable directories, and if untrusted Editor accounts exist audit for unexpected .php files.

Affected versions: ≥ 3.6.0 and < 3.6.3

Full advisory: our disclosure post