Loading vulnerability…
Unauthenticated Arbitrary File Upload RCE in Joomla Page Builder CK
CVE-2026-56290 is a critical vulnerability in the Joomla extension Page Builder CK affecting versions prior to 3.6.0. The flaw allows unauthenticated attackers to upload arbitrary files, including executable server-side scripts, through the extension's upload functionality due to missing or insufficient access control and inadequate validation of uploaded content. Public reporting also describes the vulnerable path as related to the extension's font handling and file upload logic. Successful exploitation enables attackers to place executable code in a web-accessible location and then invoke it remotely, resulting in full remote code execution on the underlying web server.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can lead to complete compromise of the affected Joomla site and the underlying server in the security context of the web server process. Attackers can execute arbitrary code remotely, deploy web shells or other backdoors, establish persistence, manipulate site content, steal credentials or application data accessible to the server, and use the compromised host for further intrusion activity. Active exploitation in the wild has been reported.
If you can’t patch tonight, do this now.
If immediate upgrading is not possible, temporarily disable or uninstall the Page Builder CK extension to remove the exposed attack surface. As a compensating control, restrict or block public access to the extension's upload-related functionality at the web server or WAF layer, prevent execution of server-side scripts from upload and media directories where feasible, and enforce strict server-side validation of allowed upload types and destinations. Increased monitoring for suspicious upload activity and unexpected executable content in web-accessible storage is also warranted.
Patch, then assume compromise.
Upgrade Page Builder CK to version 3.6.0 or later, which addresses the vulnerability. After patching, review the Joomla instance and server for signs of prior compromise, including unauthorized uploaded scripts, unexpected administrative accounts, persistence mechanisms, and other attacker modifications. Remove any malicious artifacts and rotate credentials that may have been exposed to the compromised application environment.
6 exploits validated by Mallory's analysis. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
50 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.