# Page Builder CK (com_pagebuilderck) 3.1.1 to 3.1.3 - Authenticated Arbitrary File Upload (RCE) [Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2026-63048 CVE-2026-63048CriticalCVSS 9.4CVE published 22 July 2026Added to mySites.guru 22 July 2026 # Page Builder CK (com\_pagebuilderck) 3.1.1 to 3.1.3 - Authenticated Arbitrary File Upload (RCE) Page Builder CK ships three separate release branches: 3.1.x for Joomla 3, 3.4.x for Joomla 4, and 3.6.x for Joomla 5 and 6. This rule covers the Joomla 3 branch. CVE-2026-63048 (CVSS 9.4) is an arbitrary file upload in the browse.ajaxAddPicture endpoint: the uploaded filename is not validated against any extension allow-list, so a user holding core.edit (Editor and above under default Joomla permissions) can write an executable .php file and run it. The vendor fixed this on the Joomla 5/6 branch in 3.6.3, by adding an extension allow-list together with Joomla MediaHelper::canUpload(). That fix has not been backported to the Joomla 3 branch. The 3.1.3 release of 25 August 2026 carried the styles SQL injection fix only, and the upload allow-list is still absent from 3.1.3, so 3.1.3 remains affected. The published affected range for CVE-2026-63048 is 1.0.0 to 3.6.2, which already includes every 3.1.x build. There is currently NO fixed version available on the Joomla 3 branch, so this is not a case of being behind on updates. The route to a patched build is to migrate the site to Joomla 5 or 6 and install Page Builder CK 3.6.5. Until then, restrict which user groups hold core.edit on com\_pagebuilderck, and block requests carrying task=browse.ajaxAddPicture at the WAF or reverse proxy. If the vendor later ships 3.1.4 with the allow-list restored, this rule clears on its own. Note the linked article is written on 3.6.x numbering, because the Joomla 5/6 branch is where the flaw was first fixed. Copy citation ## Is my site affected? CVE-2026-63048 is checked by 3 rules. Find the extension and release line your site runs: Extension Affected versions Fixed in What to do [Page Builder CK](https://mysites.guru/vulnerabilities/pagebuilderck/) from 3.1.1 up to but not including 3.1.4 3.1.4 Update Page Builder CK to 3.1.4 or later. [Page Builder CK](https://mysites.guru/vulnerabilities/pagebuilderck/) from 3.3.0 up to but not including 3.4.13 3.4.13 Update Page Builder CK to 3.4.13 or later. [Page Builder CK](https://mysites.guru/vulnerabilities/pagebuilderck/) from 3.6.0 up to but not including 3.6.3 3.6.3 Update Page Builder CK to 3.6.3 for this flaw, or to 3.6.5 or later, which no rule we check matches. [Check whether your sites are affected](https://mysites.guru/free-audit/) ## How CVE-2026-63048 is scored The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw. 9.4 Critical CVSS 4.0, scored by Joomla CNA `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H` ### How it is reached - **AV:N Attack vector** - Network. Reachable across the internet - **AC:L Attack complexity** - Low. Nothing to work around, it just works - **AT:N Attack requirements** - None. Works against any affected install - **PR:L Privileges required** - Low. Any logged-in account will do - **UI:N User interaction** - None. Nobody has to be tricked into anything ### What it does to the site - **VC:H Confidentiality** - High. Everything the site holds can be read - **VI:H Integrity** - High. Data and files can be altered at will - **VA:H Availability** - High. The site can be taken down ### What it does beyond the site - **SC:H Confidentiality** - High. Data on other systems can be read - **SI:H Integrity** - High. Other systems can be altered - **SA:H Availability** - High. Other systems can be taken down ## Timeline 1. 21 July 2026[We published: PageBuilder CK RCE fixed - again - correctly this time](https://mysites.guru/blog/pagebuilderck-file-upload-rce-incomplete-fix/) 2. 22 July 2026CVE-2026-63048 record published by its CNA 3. 22 July 2026mySites.guru check added for Page Builder CK (from 3.1.1 up to but not including 3.1.4) 4. 22 July 2026mySites.guru check added for Page Builder CK (from 3.3.0 up to but not including 3.4.13) ## Rule details Critical[CVE-2026-63048](https://mysites.guru/vulnerabilities/CVE-2026-63048/)2026-07-22 [Page Builder CK](https://mysites.guru/vulnerabilities/pagebuilderck/) Affected versions: ≥ 3.1.1 and < 3.1.4 Full advisory: [our disclosure post](https://mysites.guru/blog/pagebuilderck-file-upload-rce-incomplete-fix/) Critical[CVE-2026-63048](https://mysites.guru/vulnerabilities/CVE-2026-63048/)2026-07-22 [Page Builder CK](https://mysites.guru/vulnerabilities/pagebuilderck/) - Page Builder CK (com\_pagebuilderck) 3.3.0 to 3.4.12 - Authenticated Arbitrary File Upload (RCE) Page Builder CK ships three separate release branches: 3.1.x for Joomla 3, 3.4.x for Joomla 4, and 3.6.x for Joomla 5 and 6. This rule covers the Joomla 4 branch. CVE-2026-63048 (CVSS 9.4) is an arbitrary file upload in the browse.ajaxAddPicture endpoint: the uploaded filename is not validated against any extension allow-list, so a user holding core.edit (Editor and above under default Joomla permissions) can write an executable .php file and run it. The vendor fixed this on the Joomla 5/6 branch in 3.6.3, by adding an extension allow-list together with Joomla MediaHelper::canUpload(). That fix has not been backported to the Joomla 4 branch. The 3.4.12 release of 25 August 2026 carried the styles SQL injection fix only, and the upload allow-list is still absent from 3.4.12, so 3.4.12 remains affected. The published affected range for CVE-2026-63048 is 1.0.0 to 3.6.2, which already includes every 3.4.x build. There is currently NO fixed version available on the Joomla 4 branch, so this is not a case of being behind on updates. The route to a patched build is to migrate the site to Joomla 5 or 6 and install Page Builder CK 3.6.5. Until then, restrict which user groups hold core.edit on com\_pagebuilderck, and block requests carrying task=browse.ajaxAddPicture at the WAF or reverse proxy. If the vendor later ships 3.4.13 with the allow-list restored, this rule clears on its own. Note the linked article is written on 3.6.x numbering, because the Joomla 5/6 branch is where the flaw was first fixed. Affected versions: ≥ 3.3.0 and < 3.4.13 Full advisory: [our disclosure post](https://mysites.guru/blog/pagebuilderck-file-upload-rce-incomplete-fix/) [CVE-2026-63048](https://mysites.guru/vulnerabilities/CVE-2026-63048/)[CVE-2026-56290](https://mysites.guru/vulnerabilities/CVE-2026-56290/) [Page Builder CK](https://mysites.guru/vulnerabilities/pagebuilderck/) - Page Builder CK (com\_pagebuilderck) 3.6.0 to 3.6.2 - Authenticated Arbitrary File Upload (RCE, CVE-2026-63048), incomplete fix of CVE-2026-56290 The 3.6.0 fix for the critical unauthenticated file upload (CVE-2026-56290) added an access/core.edit gate at the front-end entry point but did not correct the upload handler itself: the file-extension allow-list in helpers/ckbrowse.php remained commented out through 3.6.2. Any authenticated account with core.edit (the default Editor group) could therefore still upload an attacker-named file, including .php, to a web-served folder via the front-end browse.ajaxAddPicture task and execute it - an authenticated arbitrary file upload to remote code execution, a privilege escalation from content editor to full site compromise. Assigned CVE-2026-63048 via the Joomla CNA on 22 July 2026 as the authenticated variant / incomplete fix of CVE-2026-56290. Fixed in 3.6.3, which restores the file-type allow-list (component allow-list plus Joomla core MediaHelper::canUpload) while keeping the access gate and CSRF token. Update to 3.6.3 or later. As defence in depth, block PHP execution in writable directories, and if untrusted Editor accounts exist audit for unexpected .php files. Affected versions: ≥ 3.6.0 and < 3.6.3 Full advisory: [our disclosure post](https://mysites.guru/blog/pagebuilderck-file-upload-rce-incomplete-fix/) ## Our disclosure post [![PageBuilder CK RCE fixed - again - correctly this time](https://mysites.guru/_astro/pagebuilderck-file-upload-rce-incomplete-fix.CR8AST-y_280TkI.webp) ### PageBuilder CK RCE fixed - again - correctly this time PageBuilder CK's 3.6.0 fix for its file-upload RCE (CVE-2026-56290) added just a login check; any Editor could still run code. Fixed in 3.6.3. Be on 3.6.5. 21 Jul 2026 ](https://mysites.guru/blog/pagebuilderck-file-upload-rce-incomplete-fix/) ## Other vulnerabilities in Page Builder CK Updating for CVE-2026-63048 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension. ### [Page Builder CK](https://mysites.guru/vulnerabilities/pagebuilderck/) Latest safe version: 3.6.5 - [CVE-2026-56290](https://mysites.guru/vulnerabilities/CVE-2026-56290/) Critical, before 3.1.1 - [CVE-2026-74254](https://mysites.guru/vulnerabilities/CVE-2026-74254/) Critical, from 3.6.3 up to but not including 3.6.4 - [CVE-2026-77993](https://mysites.guru/vulnerabilities/CVE-2026-77993/) High, from 3.6.4 up to but not including 3.6.5 - [CVE-2026-77994](https://mysites.guru/vulnerabilities/CVE-2026-77994/) High, from 3.6.4 up to but not including 3.6.5 - [CVE-2026-62414](https://mysites.guru/vulnerabilities/CVE-2026-62414/) Medium, from 3.6.0 up to and including 3.6.1 ## References - [CVE-2026-63048 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-63048) - [CVE-2026-63048 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-63048) - [PageBuilder CK RCE fixed - again - correctly this time](https://mysites.guru/blog/pagebuilderck-file-upload-rce-incomplete-fix/) ## CVE-2026-63048 questions Show all Which versions are affected by CVE-2026-63048? [CVE-2026-63048](https://mysites.guru/vulnerabilities/CVE-2026-63048/) is covered by 3 rules: Page Builder CK from 3.1.1 up to but not including 3.1.4; Page Builder CK from 3.3.0 up to but not including 3.4.13; Page Builder CK from 3.6.0 up to but not including 3.6.3. How do I fix CVE-2026-63048? It depends on the extension and release line your site runs. For Page Builder CK from 3.1.1 up to but not including 3.1.4: update Page Builder CK to 3.1.4 or later. For Page Builder CK from 3.3.0 up to but not including 3.4.13: update Page Builder CK to 3.4.13 or later. For Page Builder CK from 3.6.0 up to but not including 3.6.3: update Page Builder CK to 3.6.3 for this flaw, or to 3.6.5 or later, which no rule we check matches. How severe is CVE-2026-63048? Joomla CNA scores it 9.4 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, any logged-in account will do and nobody has to be tricked into anything. ## Running an affected version on a site you manage? A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day. This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/). Rules current as of 14 October 2026.