Affected versions: ≥ 3.1.1 and < 3.1.4
Full advisory: our disclosure post
CVE-2026-63048CriticalCVSS 9.4CVE published 22 July 2026Added to mySites.guru 22 July 2026
Page Builder CK (com_pagebuilderck) 3.1.1 to 3.1.3 - Authenticated Arbitrary File Upload (RCE)
Page Builder CK ships three separate release branches: 3.1.x for Joomla 3, 3.4.x for Joomla 4, and 3.6.x for Joomla 5 and 6. This rule covers the Joomla 3 branch. CVE-2026-63048 (CVSS 9.4) is an arbitrary file upload in the browse.ajaxAddPicture endpoint: the uploaded filename is not validated against any extension allow-list, so a user holding core.edit (Editor and above under default Joomla permissions) can write an executable .php file and run it. The vendor fixed this on the Joomla 5/6 branch in 3.6.3, by adding an extension allow-list together with Joomla MediaHelper::canUpload(). That fix has not been backported to the Joomla 3 branch. The 3.1.3 release of 25 August 2026 carried the styles SQL injection fix only, and the upload allow-list is still absent from 3.1.3, so 3.1.3 remains affected. The published affected range for CVE-2026-63048 is 1.0.0 to 3.6.2, which already includes every 3.1.x build. There is currently NO fixed version available on the Joomla 3 branch, so this is not a case of being behind on updates. The route to a patched build is to migrate the site to Joomla 5 or 6 and install Page Builder CK 3.6.5. Until then, restrict which user groups hold core.edit on com_pagebuilderck, and block requests carrying task=browse.ajaxAddPicture at the WAF or reverse proxy. If the vendor later ships 3.1.4 with the allow-list restored, this rule clears on its own. Note the linked article is written on 3.6.x numbering, because the Joomla 5/6 branch is where the flaw was first fixed.
Is my site affected?
CVE-2026-63048 is checked by 3 rules. Find the extension and release line your site runs:
| Extension | Affected versions | Fixed in | What to do |
|---|---|---|---|
| Page Builder CK | from 3.1.1 up to but not including 3.1.4 | 3.1.4 | Update Page Builder CK to 3.1.4 or later. |
| Page Builder CK | from 3.3.0 up to but not including 3.4.13 | 3.4.13 | Update Page Builder CK to 3.4.13 or later. |
| Page Builder CK | from 3.6.0 up to but not including 3.6.3 | 3.6.3 | Update Page Builder CK to 3.6.3 for this flaw, or to 3.6.5 or later, which no rule we check matches. |
How CVE-2026-63048 is scored
The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
9.4 Critical
CVSS 4.0, scored by Joomla CNACVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:N Attack requirements
- None. Works against any affected install
- PR:L Privileges required
- Low. Any logged-in account will do
- UI:N User interaction
- None. Nobody has to be tricked into anything
What it does to the site
- VC:H Confidentiality
- High. Everything the site holds can be read
- VI:H Integrity
- High. Data and files can be altered at will
- VA:H Availability
- High. The site can be taken down
What it does beyond the site
- SC:H Confidentiality
- High. Data on other systems can be read
- SI:H Integrity
- High. Other systems can be altered
- SA:H Availability
- High. Other systems can be taken down
Timeline
- 21 July 2026We published: PageBuilder CK RCE fixed - again - correctly this time
- 22 July 2026CVE-2026-63048 record published by its CNA
- 22 July 2026mySites.guru check added for Page Builder CK (from 3.1.1 up to but not including 3.1.4)
- 22 July 2026mySites.guru check added for Page Builder CK (from 3.3.0 up to but not including 3.4.13)
Rule details
Page Builder CK - Page Builder CK (com_pagebuilderck) 3.3.0 to 3.4.12 - Authenticated Arbitrary File Upload (RCE)
Page Builder CK ships three separate release branches: 3.1.x for Joomla 3, 3.4.x for Joomla 4, and 3.6.x for Joomla 5 and 6. This rule covers the Joomla 4 branch. CVE-2026-63048 (CVSS 9.4) is an arbitrary file upload in the browse.ajaxAddPicture endpoint: the uploaded filename is not validated against any extension allow-list, so a user holding core.edit (Editor and above under default Joomla permissions) can write an executable .php file and run it. The vendor fixed this on the Joomla 5/6 branch in 3.6.3, by adding an extension allow-list together with Joomla MediaHelper::canUpload(). That fix has not been backported to the Joomla 4 branch. The 3.4.12 release of 25 August 2026 carried the styles SQL injection fix only, and the upload allow-list is still absent from 3.4.12, so 3.4.12 remains affected. The published affected range for CVE-2026-63048 is 1.0.0 to 3.6.2, which already includes every 3.4.x build. There is currently NO fixed version available on the Joomla 4 branch, so this is not a case of being behind on updates. The route to a patched build is to migrate the site to Joomla 5 or 6 and install Page Builder CK 3.6.5. Until then, restrict which user groups hold core.edit on com_pagebuilderck, and block requests carrying task=browse.ajaxAddPicture at the WAF or reverse proxy. If the vendor later ships 3.4.13 with the allow-list restored, this rule clears on its own. Note the linked article is written on 3.6.x numbering, because the Joomla 5/6 branch is where the flaw was first fixed.
Affected versions: ≥ 3.3.0 and < 3.4.13
Full advisory: our disclosure post
Page Builder CK - Page Builder CK (com_pagebuilderck) 3.6.0 to 3.6.2 - Authenticated Arbitrary File Upload (RCE, CVE-2026-63048), incomplete fix of CVE-2026-56290
The 3.6.0 fix for the critical unauthenticated file upload (CVE-2026-56290) added an access/core.edit gate at the front-end entry point but did not correct the upload handler itself: the file-extension allow-list in helpers/ckbrowse.php remained commented out through 3.6.2. Any authenticated account with core.edit (the default Editor group) could therefore still upload an attacker-named file, including .php, to a web-served folder via the front-end browse.ajaxAddPicture task and execute it - an authenticated arbitrary file upload to remote code execution, a privilege escalation from content editor to full site compromise. Assigned CVE-2026-63048 via the Joomla CNA on 22 July 2026 as the authenticated variant / incomplete fix of CVE-2026-56290. Fixed in 3.6.3, which restores the file-type allow-list (component allow-list plus Joomla core MediaHelper::canUpload) while keeping the access gate and CSRF token. Update to 3.6.3 or later. As defence in depth, block PHP execution in writable directories, and if untrusted Editor accounts exist audit for unexpected .php files.
Affected versions: ≥ 3.6.0 and < 3.6.3
Full advisory: our disclosure post
Our disclosure post
Other vulnerabilities in Page Builder CK
Updating for CVE-2026-63048 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.
Page Builder CK
Latest safe version: 3.6.5
- CVE-2026-56290 Critical, before 3.1.1
- CVE-2026-74254 Critical, from 3.6.3 up to but not including 3.6.4
- CVE-2026-77993 High, from 3.6.4 up to but not including 3.6.5
- CVE-2026-77994 High, from 3.6.4 up to but not including 3.6.5
- CVE-2026-62414 Medium, from 3.6.0 up to and including 3.6.1
References
- CVE-2026-63048 on cve.org (the official CVE record)
- CVE-2026-63048 in the NIST National Vulnerability Database
- PageBuilder CK RCE fixed - again - correctly this time
CVE-2026-63048 questions
Which versions are affected by CVE-2026-63048?
CVE-2026-63048 is covered by 3 rules: Page Builder CK from 3.1.1 up to but not including 3.1.4; Page Builder CK from 3.3.0 up to but not including 3.4.13; Page Builder CK from 3.6.0 up to but not including 3.6.3.
How do I fix CVE-2026-63048?
It depends on the extension and release line your site runs. For Page Builder CK from 3.1.1 up to but not including 3.1.4: update Page Builder CK to 3.1.4 or later. For Page Builder CK from 3.3.0 up to but not including 3.4.13: update Page Builder CK to 3.4.13 or later. For Page Builder CK from 3.6.0 up to but not including 3.6.3: update Page Builder CK to 3.6.3 for this flaw, or to 3.6.5 or later, which no rule we check matches.
How severe is CVE-2026-63048?
Joomla CNA scores it 9.4 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, any logged-in account will do and nobody has to be tricked into anything.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 8 October 2026.