Page Builder CK (com_pagebuilderck) 3.1.1 to 3.1.3 - Authenticated Arbitrary File Upload (RCE)
Page Builder CK ships three separate release branches: 3.1.x for Joomla 3, 3.4.x for Joomla 4, and 3.6.x for Joomla 5 and 6. This rule covers the Joomla 3 branch. CVE-2026-63048 (CVSS 9.4) is an arbitrary file upload in the browse.ajaxAddPicture endpoint: the uploaded filename is not validated against any extension allow-list, so a user holding core.edit (Editor and above under default Joomla permissions) can write an executable .php file and run it. The vendor fixed this on the Joomla 5/6 branch in 3.6.3, by adding an extension allow-list together with Joomla MediaHelper::canUpload(). That fix has not been backported to the Joomla 3 branch. The 3.1.3 release of 25 August 2026 carried the styles SQL injection fix only, and the upload allow-list is still absent from 3.1.3, so 3.1.3 remains affected. The published affected range for CVE-2026-63048 is 1.0.0 to 3.6.2, which already includes every 3.1.x build. There is currently NO fixed version available on the Joomla 3 branch, so this is not a case of being behind on updates. The route to a patched build is to migrate the site to Joomla 5 or 6 and install Page Builder CK 3.6.5. Until then, restrict which user groups hold core.edit on com_pagebuilderck, and block requests carrying task=browse.ajaxAddPicture at the WAF or reverse proxy. If the vendor later ships 3.1.4 with the allow-list restored, this rule clears on its own. Note the linked article is written on 3.6.x numbering, because the Joomla 5/6 branch is where the flaw was first fixed.
Affected versions: ≥ 3.1.1 and < 3.1.4
Full advisory: our disclosure post
Page Builder CK (com_pagebuilderck) 3.3.0 to 3.4.12 - Authenticated Arbitrary File Upload (RCE)
Page Builder CK ships three separate release branches: 3.1.x for Joomla 3, 3.4.x for Joomla 4, and 3.6.x for Joomla 5 and 6. This rule covers the Joomla 4 branch. CVE-2026-63048 (CVSS 9.4) is an arbitrary file upload in the browse.ajaxAddPicture endpoint: the uploaded filename is not validated against any extension allow-list, so a user holding core.edit (Editor and above under default Joomla permissions) can write an executable .php file and run it. The vendor fixed this on the Joomla 5/6 branch in 3.6.3, by adding an extension allow-list together with Joomla MediaHelper::canUpload(). That fix has not been backported to the Joomla 4 branch. The 3.4.12 release of 25 August 2026 carried the styles SQL injection fix only, and the upload allow-list is still absent from 3.4.12, so 3.4.12 remains affected. The published affected range for CVE-2026-63048 is 1.0.0 to 3.6.2, which already includes every 3.4.x build. There is currently NO fixed version available on the Joomla 4 branch, so this is not a case of being behind on updates. The route to a patched build is to migrate the site to Joomla 5 or 6 and install Page Builder CK 3.6.5. Until then, restrict which user groups hold core.edit on com_pagebuilderck, and block requests carrying task=browse.ajaxAddPicture at the WAF or reverse proxy. If the vendor later ships 3.4.13 with the allow-list restored, this rule clears on its own. Note the linked article is written on 3.6.x numbering, because the Joomla 5/6 branch is where the flaw was first fixed.
Affected versions: ≥ 3.3.0 and < 3.4.13
Full advisory: our disclosure post
Page Builder CK (com_pagebuilderck) below 3.1.1 - Unauthenticated Arbitrary File Upload (RCE, CVE-2026-56290)
Page Builder CK is affected by a critical unauthenticated arbitrary file upload that leads to remote code execution. The front-end browse.ajaxAddPicture task is gated only by an anti-CSRF token (freely readable by any visitor) with no authorisation check, no extension allow-list and no path confinement, so a guest can upload any file - including a .php web shell - to any folder, and path traversal can even write outside the web root. Both the free and Pro editions are affected on Joomla 3, 4, 5 and 6. The developer has released secured back-branch builds: update to 3.1.1+ (Joomla 3 line), 3.4.10+ (Joomla 4 line) or 3.6.3+ (Joomla 5/6 line) via the Joomla Update Manager. On the Joomla 5/6 line do not stop at 3.6.0-3.6.2: those builds closed the anonymous path but left the upload file-type allow-list disabled, so any Editor-level account could still upload and run PHP (CVE-2026-63048); 3.6.3 restores the allow-list. Because the upload can land anywhere, audit the whole site (not just /images) for unexpected .php files. The unauthenticated flaw is tracked as CVE-2026-56290 (CVSS 10.0).
Affected versions: < 3.1.1
Full advisory: our disclosure post
Page Builder CK (com_pagebuilderck) 3.4.0 to 3.4.9 - Unauthenticated Arbitrary File Upload (RCE, CVE-2026-56290)
Page Builder CK is affected by a critical unauthenticated arbitrary file upload that leads to remote code execution. The front-end browse.ajaxAddPicture task is gated only by an anti-CSRF token (freely readable by any visitor) with no authorisation check, no extension allow-list and no path confinement, so a guest can upload any file - including a .php web shell - to any folder, and path traversal can even write outside the web root. Both the free and Pro editions are affected on Joomla 3, 4, 5 and 6. The developer has released secured back-branch builds: update to 3.1.1+ (Joomla 3 line), 3.4.10+ (Joomla 4 line) or 3.6.3+ (Joomla 5/6 line) via the Joomla Update Manager. On the Joomla 5/6 line do not stop at 3.6.0-3.6.2: those builds closed the anonymous path but left the upload file-type allow-list disabled, so any Editor-level account could still upload and run PHP (CVE-2026-63048); 3.6.3 restores the allow-list. Because the upload can land anywhere, audit the whole site (not just /images) for unexpected .php files. The unauthenticated flaw is tracked as CVE-2026-56290 (CVSS 10.0).
Affected versions: ≥ 3.4.0 and < 3.4.10
Full advisory: our disclosure post
Page Builder CK (com_pagebuilderck) 3.5.0 to 3.5.x - Unauthenticated Arbitrary File Upload (RCE, CVE-2026-56290)
Page Builder CK is affected by a critical unauthenticated arbitrary file upload that leads to remote code execution. The front-end browse.ajaxAddPicture task is gated only by an anti-CSRF token (freely readable by any visitor) with no authorisation check, no extension allow-list and no path confinement, so a guest can upload any file - including a .php web shell - to any folder, and path traversal can even write outside the web root. Both the free and Pro editions are affected on Joomla 3, 4, 5 and 6. The developer has released secured back-branch builds: update to 3.1.1+ (Joomla 3 line), 3.4.10+ (Joomla 4 line) or 3.6.3+ (Joomla 5/6 line) via the Joomla Update Manager. On the Joomla 5/6 line do not stop at 3.6.0-3.6.2: those builds closed the anonymous path but left the upload file-type allow-list disabled, so any Editor-level account could still upload and run PHP (CVE-2026-63048); 3.6.3 restores the allow-list. Because the upload can land anywhere, audit the whole site (not just /images) for unexpected .php files. The unauthenticated flaw is tracked as CVE-2026-56290 (CVSS 10.0).
Affected versions: ≥ 3.5.0 and < 3.6.0
Full advisory: our disclosure post
Page Builder CK (com_pagebuilderck) 3.6.3 - SQL Injection in the styles model (CVE-2026-74254, CVSS 9.3 Critical)
Page Builder CK 3.6.3 is affected by SQL injection in its styles handling, tracked as CVE-2026-74254 and scored CVSS 4.0 9.3 Critical by the Joomla CNA with no privileges required. Style identifiers are interpolated into an SQL IN(...) clause with no escaping or integer casting. The vendor needed two releases to close it: 3.6.4 fixed the front-end vector, which is the one the CNA scored as requiring no privileges because it runs when a page is rendered, and 3.6.5 fixed the equivalent administrator vector. On 3.6.3 both vectors are open, so update to 3.6.5 and do not stop at 3.6.4. The same release also removes a reflected cross-site scripting flaw in the Page Builder CK editor plugin, which echoed a query string parameter into a hidden form field without escaping. Until you can update, restrict edit permissions on com_pagebuilderck to trusted users only, and review your Page Builder CK pages for unexpected content.
Affected versions: ≥ 3.6.3 and < 3.6.4
Full advisory: our disclosure post
Page Builder CK (com_pagebuilderck) 3.6.4 - SQL Injection in the styles model, backend vector still open (CVE-2026-74254)
Page Builder CK 3.6.4 is still affected by CVE-2026-74254, the SQL injection in the styles handling, because that release only fixed half of it. The CNA records the whole issue as affecting versions 1.0.0 to 3.6.4 and scores it CVSS 4.0 9.3 Critical: 3.6.4 fixed the front-end vector, and 3.6.5 fixed the administrator one. On 3.6.4 specifically the remaining route is the administrator path, where the sanitising call discarded its own return value so the uncast style identifiers still reached the query, and reaching it needs an authenticated account with content editing rights on the component plus a valid session token. That is why this rule is scored lower than the 3.6.3 rule even though both carry the same CVE. Update to 3.6.5 or later, which applies the sanitising properly. Until you can update, restrict edit permissions on com_pagebuilderck to trusted users only.
Affected versions: ≥ 3.6.4 and < 3.6.5
Full advisory: our disclosure post
Page Builder CK (com_pagebuilderck) <= 3.6.1 - Unauthenticated Broken Access Control (frontend page list disclosure, CVE-2026-62414)
Page Builder CK by joomlack.fr does not properly apply access control to front-end page list views (CVE-2026-62414), exposing restricted page lists to unauthenticated visitors. Affects all versions 1.0.0 through 3.6.1; fixed in 3.6.2. This broad rule covers the mid-range versions (3.1.1-3.3.x, 3.4.10-3.4.11) skipped by the per-CVE Page Builder CK upload rules.
Affected versions: ≥ 3.6.0 and ≤ 3.6.1
Full advisory: nvd.nist.gov
Page Builder CK (com_pagebuilderck) 3.6.0 to 3.6.2 - Authenticated Arbitrary File Upload (RCE, CVE-2026-63048), incomplete fix of CVE-2026-56290
The 3.6.0 fix for the critical unauthenticated file upload (CVE-2026-56290) added an access/core.edit gate at the front-end entry point but did not correct the upload handler itself: the file-extension allow-list in helpers/ckbrowse.php remained commented out through 3.6.2. Any authenticated account with core.edit (the default Editor group) could therefore still upload an attacker-named file, including .php, to a web-served folder via the front-end browse.ajaxAddPicture task and execute it - an authenticated arbitrary file upload to remote code execution, a privilege escalation from content editor to full site compromise. Assigned CVE-2026-63048 via the Joomla CNA on 22 July 2026 as the authenticated variant / incomplete fix of CVE-2026-56290. Fixed in 3.6.3, which restores the file-type allow-list (component allow-list plus Joomla core MediaHelper::canUpload) while keeping the access gate and CSRF token. Update to 3.6.3 or later. As defence in depth, block PHP execution in writable directories, and if untrusted Editor accounts exist audit for unexpected .php files.
Affected versions: ≥ 3.6.0 and < 3.6.3
Full advisory: our disclosure post
Page Builder CK (com_pagebuilderck) below 3.6.5 - Unauthenticated SQL Injection (CVE-2026-77994, CVSS 9.3 Critical) and Reflected XSS (CVE-2026-77993)
Page Builder CK versions 1.0.0 to 3.6.4 are affected by two unauthenticated vulnerabilities published by the Joomla CNA on 24 August 2026. CVE-2026-77994 (CVSS 9.3 Critical, CWE-89) is a second order SQL injection in the loadStyles method of the frontend page model. The CVSS vector is AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, so no login, no CSRF token and no user interaction are required: an anonymous visitor can read and modify the entire Joomla database, including the password hashes in #__users. CVE-2026-77993 (CVSS 5.3 Medium, CWE-79) is a reflected cross-site scripting flaw via the iscontenttype parameter. It is also unauthenticated, but needs the victim to follow a crafted link (UI:P). Both are fixed in Page Builder CK 3.6.5. Both were reported by Ala Arfaoui. Update to 3.6.5 or later. Page Builder CK has shipped a run of security releases across the 3.6.x line, so an earlier 3.6.x build is not a safe ceiling. If you cannot update straight away, block anonymous requests to index.php?option=com_pagebuilderck at your web server or WAF. Because the SQL injection is unauthenticated and reachable on the front end, treat any database contents as potentially read and rotate administrator passwords after updating.
Affected versions: ≥ 3.6.0 and < 3.6.5
Full advisory: www.cve.org