Page Builder CK CVE-2026-56290: Exploited Joomla Upload RCE

What to do

1. Inventory every Joomla site and check whether Page Builder CK (com_pagebuilderck) is installed and at which version.
2. Update to Page Builder CK 3.6.5 or later (3.6.7 is current); 3.6.0 closes only the unauthenticated hole.
3. On Joomla 3 or 4, plan a move to Joomla 5 or 6 or remove the extension, because no back-port is documented as fixing the authenticated follow-up bug.
4. If you cannot update today, disable or uninstall the extension; unpublishing its pages does not close the hole.
5. Search media/com_pagebuilderck/ and the rest of the web root for PHP files you did not put there; if you find one, restore from a clean backup and rotate credentials.

How to check if you are affected or compromised

• Run find media/com_pagebuilderck -name '*.php' from the Joomla root; any hit, such as gfonts/bhup.php, is a red flag.
• Search PHP files for the uploader marker $_POST['_upl'] with grep -rl "_upl" --include=*.php .
• Search web server access logs for external POST requests to index.php that reference com_pagebuilderck.
• List Joomla users and look for Super User or administrator accounts you did not create.

What happened#

On June 27, 2026, Joomlack released Page Builder CK 3.6.0, a drag-and-drop page builder for Joomla (com_pagebuilderck). The changelog entry read "IMPORTANT : Fix security issue." Two days later the Joomla CNA published CVE-2026-56290, an unauthenticated arbitrary file upload that "allows uploading executable files and leads to full RCE." The CNA scores it CVSS 4.0 10.0 with exploit maturity "Attacked." NVD rates it CVSS 3.1 9.8. CISA added it to the KEV catalog on July 7, with a July 10 deadline.

The finder, Phil Taylor of mySites.guru, says a front-end image upload endpoint was reachable without logging in. Its only check was Joomla's anti-CSRF token, which any visitor can read from the site's public pages. It also took the destination folder and the file name, extension included, from the request. mySites.guru found a live web shell at /media/com_pagebuilderck/gfonts/bhup.php on a monitored site "within hours" of the fix shipping. Beazley Security traces the bug to the extension's font-saving task, which fetches a remote URL and writes the result into that web-accessible media folder. It also notes that a public proof of concept automates the attack.

The first fix was incomplete. According to mySites.guru's updated advisory, 3.6.0 added a permission check but did not correct the upload handler, so any Editor account could still upload PHP up to 3.6.2. That bug is CVE-2026-63048 (CVSS 4.0 9.4, fixed in 3.6.3). A separate unauthenticated SQL injection in the styles model, CVE-2026-74254 (9.3), is fixed in 3.6.5. Neither is in KEV.

Who is affected#

Any Joomla site running Page Builder CK at 3.5.10 or older, Light (free) or Pro, is open to the unauthenticated upload. Versions 3.6.0 through 3.6.2 are still exposed to the authenticated variant, and everything below 3.6.5 to the SQL injection. The vendor page lists 3.6.7, dated October 19, as the current release.

Joomla 3 and 4 sites cannot run the 3.6 line. Joomlack shipped back-ported fixes: mySites.guru lists 3.1.1 and 3.4.10, and the vendor forum later linked 3.1.2 and 3.4.11 builds. However, the CVE-2026-63048 record lists those lines as affected through 3.1.2 and 3.4.11. No later back-port has been documented as of Oct 21, 2026. Singapore's Cyber Security Agency issued an alert on July 10 covering this flaw and an exploited SP Page Builder bug.

Do you really need to act?#

Only if you run the extension, but then yes, urgently. The attack needs no account, the CSRF token is public, and CISA rates exploitation automatable with total technical impact. Attackers moved within hours of the patch, so assume any site that sat on 3.5.10 or older after June 27 has been probed. Updating does not remove a shell that is already in place.

mySites.guru warns that two shortcuts do not work. Unpublishing the component or its pages leaves the endpoint reachable. Blocking PHP execution in one folder such as /images does not help either, because the attacker chooses where the file lands. Sites that do not use Joomla, and Joomla sites without Page Builder CK, can ignore this.

What to do now#

1. Check for the extension and its version from the Joomla root with grep -h "<version>" administrator/components/com_pagebuilderck/*.xml, or under System, Manage, Extensions.
2. Update to 3.6.5 or later (3.6.7 is current). Stopping at 3.6.0 leaves the authenticated upload and the SQL injection open.
3. On Joomla 3 or 4, plan the move to Joomla 5 or 6, or uninstall the extension.
4. If you cannot update today, disable or uninstall the extension. Alternatively, block public requests to its component endpoints, such as POSTs carrying option=com_pagebuilderck, at your web server or WAF.
5. If you find a shell, restore from a known-clean backup, update, then change Joomla administrator, database and hosting passwords and the $secret value in configuration.php.

How to tell if you were hit#

From the Joomla root, run find media/com_pagebuilderck -name '*.php'. A stray file such as gfonts/bhup.php is a strong sign of compromise. The shell mySites.guru found contains if( $_POST['_upl'] == "Upload" ) {, so it is also worth running grep -rl "_upl" --include=*.php . across the whole site. Because the attacker picks the destination, check images, media, templates and administrator for unfamiliar or recently changed PHP files, for example with find . -name '*.php' -newermt 2026-06-27. Review the Users list for Super User accounts you did not create. Search access logs for external POST requests to index.php that reference com_pagebuilderck. mySites.guru recommends a full audit rather than deleting only the file you found.

Timeline#

• Jun 27, 2026 — Page Builder CK 3.6.0 ships with Joomla 3/4 back-ports. mySites.guru publishes its advisory and finds a live web shell within hours.
• Jun 29, 2026 — CVE-2026-56290 is published (CVSS 4.0 10.0). Version 3.6.1 hardens the Google Fonts manager and AJAX requests.
• Jul 7, 2026 — CISA adds CVE-2026-56290 to KEV.
• Jul 10, 2026 — CISA's federal remediation deadline. CSA Singapore issues its alert.
• Jul 21, 2026 — Version 3.6.3 adds media manager upload authorization. CVE-2026-63048 is published the next day.
• Aug 17, 2026 — Version 3.6.5 fixes the styles SQL injection, and CVE-2026-74254 is published.
• Oct 19, 2026 — Version 3.6.7 is released and is the current version.

Vulnerability records

• CVE-2026-56290 · KEV 2026-07-07 · Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Joomlack — Page Builder CK product page and changelog joomlack.fr
2. CVE record — CVE-2026-56290 cve.org
3. NVD — CVE-2026-56290 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2026-56290 cisa.gov
5. Joomlack forum — Nouvelle version de pbck et joomla 3 (patched Joomla 3/4 builds) forum.joomlack.fr
6. mySites.guru — PageBuilder CK unauthenticated file upload RCE (CVE-2026-56290) mysites.guru
7. CVE record — CVE-2026-63048 (Page Builder CK authenticated file upload) cve.org
8. CVE record — CVE-2026-74254 (Page Builder CK SQL injection) cve.org
9. Beazley Security Labs — BSL-A1187: Multiple Joomla extension vulnerabilities added to CISA KEV labs.beazley.security
10. Cyber Security Agency of Singapore — AL-2026-085: Active exploitation of critical vulnerabilities in Joomla extensions csa.gov.sg