---
title: "Page Builder CK CVE-2026-56290: Exploited Joomla Upload RCE"
url: https://erroneo.us/security/briefs/joomlack-page-builder-ck-cve-2026-56290-file-upload-rce/
description: "Unauthenticated PHP upload in Joomlack's Page Builder CK (3.5.10 and older), exploited within hours and in KEV. Follow-up bugs too: run 3.6.5 or later."
type: security-brief
section: "Security Digest"
date_published: 2026-06-27
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-56290"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Page Builder CK CVE-2026-56290: Exploited Joomla Upload RCE

**Verdict: Check exposure.** Only Joomla sites running Page Builder CK are at risk, but for them this is an emergency: an unauthenticated web-shell upload exploited within hours of the patch, with an incomplete first fix, so update to 3.6.5 or later and hunt for shells.

- **Who must act:** Anyone who runs or maintains Joomla sites with Joomlack's Page Builder CK (com_pagebuilderck), Light or Pro, including agencies looking after many client sites.
- **Who can relax:** Sites that do not use Joomla, and Joomla sites without Page Builder CK installed.
- **Affected:** Page Builder CK 1.0 through 3.5.10 (CVE-2026-56290, unauthenticated upload); Page Builder CK 3.5.0 through 3.6.2, Joomla 3 builds through 3.1.2 and Joomla 4 builds through 3.4.11 (CVE-2026-63048, authenticated upload); Page Builder CK through 3.6.4 (CVE-2026-74254, SQL injection)
- **Fixed:** Page Builder CK 3.6.0 (CVE-2026-56290); Joomla 3/4 back-ports 3.1.1 and 3.4.10 per mySites.guru; the vendor forum later linked 3.1.2 and 3.4.11 (CVE-2026-56290 only); Page Builder CK 3.6.3 (CVE-2026-63048); Page Builder CK 3.6.5 (CVE-2026-74254); 3.6.7 is current
- **CVEs:** CVE-2026-56290
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every Joomla site and check whether Page Builder CK (com_pagebuilderck) is installed and at which version.
2. Update to Page Builder CK 3.6.5 or later (3.6.7 is current); 3.6.0 closes only the unauthenticated hole.
3. On Joomla 3 or 4, plan a move to Joomla 5 or 6 or remove the extension, because no back-port is documented as fixing the authenticated follow-up bug.
4. If you cannot update today, disable or uninstall the extension; unpublishing its pages does not close the hole.
5. Search media/com_pagebuilderck/ and the rest of the web root for PHP files you did not put there; if you find one, restore from a clean backup and rotate credentials.

### How to check if you are affected

- Run find media/com_pagebuilderck -name '*.php' from the Joomla root; any hit, such as gfonts/bhup.php, is a red flag.
- Search PHP files for the uploader marker $_POST['_upl'] with grep -rl "_upl" --include=*.php .
- Search web server access logs for external POST requests to index.php that reference com_pagebuilderck.
- List Joomla users and look for Super User or administrator accounts you did not create.

## What happened

On June 27, 2026, Joomlack released Page Builder CK 3.6.0, a drag-and-drop page builder for Joomla (`com_pagebuilderck`). The changelog entry read "IMPORTANT : Fix security issue." Two days later the Joomla CNA published [CVE-2026-56290](https://www.cve.org/CVERecord?id=CVE-2026-56290), an unauthenticated arbitrary file upload that "allows uploading executable files and leads to full RCE." The CNA scores it CVSS 4.0 10.0 with exploit maturity "Attacked." [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-56290) rates it CVSS 3.1 9.8. CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290) on July 7, with a July 10 deadline.

The finder, Phil Taylor of [mySites.guru](https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/), says a front-end image upload endpoint was reachable without logging in. Its only check was Joomla's anti-CSRF token, which any visitor can read from the site's public pages. It also took the destination folder and the file name, extension included, from the request. mySites.guru found a live web shell at `/media/com_pagebuilderck/gfonts/bhup.php` on a monitored site "within hours" of the fix shipping. [Beazley Security](https://labs.beazley.security/advisories/BSL-A1187) traces the bug to the extension's font-saving task, which fetches a remote URL and writes the result into that web-accessible media folder. It also notes that a public proof of concept automates the attack.

The first fix was incomplete. According to mySites.guru's updated advisory, 3.6.0 added a permission check but did not correct the upload handler, so any Editor account could still upload PHP up to 3.6.2. That bug is [CVE-2026-63048](https://www.cve.org/CVERecord?id=CVE-2026-63048) (CVSS 4.0 9.4, fixed in 3.6.3). A separate unauthenticated SQL injection in the styles model, [CVE-2026-74254](https://www.cve.org/CVERecord?id=CVE-2026-74254) (9.3), is fixed in 3.6.5. Neither is in KEV.

## Who is affected

Any Joomla site running Page Builder CK at 3.5.10 or older, Light (free) or Pro, is open to the unauthenticated upload. Versions 3.6.0 through 3.6.2 are still exposed to the authenticated variant, and everything below 3.6.5 to the SQL injection. The [vendor page](https://www.joomlack.fr/en/joomla-extensions/page-builder-ck) lists 3.6.7, dated October 19, as the current release.

Joomla 3 and 4 sites cannot run the 3.6 line. Joomlack shipped back-ported fixes: mySites.guru lists 3.1.1 and 3.4.10, and the [vendor forum](https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3) later linked 3.1.2 and 3.4.11 builds. However, the CVE-2026-63048 record lists those lines as affected through 3.1.2 and 3.4.11. No later back-port has been documented as of Oct 21, 2026. Singapore's [Cyber Security Agency](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-085/) issued an alert on July 10 covering this flaw and an exploited SP Page Builder bug.

## Do you really need to act?

Only if you run the extension, but then yes, urgently. The attack needs no account, the CSRF token is public, and CISA rates exploitation automatable with total technical impact. Attackers moved within hours of the patch, so assume any site that sat on 3.5.10 or older after June 27 has been probed. Updating does not remove a shell that is already in place.

mySites.guru warns that two shortcuts do not work. Unpublishing the component or its pages leaves the endpoint reachable. Blocking PHP execution in one folder such as `/images` does not help either, because the attacker chooses where the file lands. Sites that do not use Joomla, and Joomla sites without Page Builder CK, can ignore this.

## What to do now

1. Check for the extension and its version from the Joomla root with `grep -h "<version>" administrator/components/com_pagebuilderck/*.xml`, or under System, Manage, Extensions.
2. Update to 3.6.5 or later (3.6.7 is current). Stopping at 3.6.0 leaves the authenticated upload and the SQL injection open.
3. On Joomla 3 or 4, plan the move to Joomla 5 or 6, or uninstall the extension.
4. If you cannot update today, disable or uninstall the extension. Alternatively, block public requests to its component endpoints, such as POSTs carrying `option=com_pagebuilderck`, at your web server or WAF.
5. If you find a shell, restore from a known-clean backup, update, then change Joomla administrator, database and hosting passwords and the `$secret` value in `configuration.php`.

## How to tell if you were hit

From the Joomla root, run `find media/com_pagebuilderck -name '*.php'`. A stray file such as `gfonts/bhup.php` is a strong sign of compromise. The shell mySites.guru found contains `if( $_POST['_upl'] == "Upload" ) {`, so it is also worth running `grep -rl "_upl" --include=*.php .` across the whole site. Because the attacker picks the destination, check `images`, `media`, `templates` and `administrator` for unfamiliar or recently changed PHP files, for example with `find . -name '*.php' -newermt 2026-06-27`. Review the Users list for Super User accounts you did not create. Search access logs for external POST requests to `index.php` that reference `com_pagebuilderck`. mySites.guru recommends a full audit rather than deleting only the file you found.

## Timeline

- Jun 27, 2026 — Page Builder CK 3.6.0 ships with Joomla 3/4 back-ports. mySites.guru publishes its advisory and finds a live web shell within hours.
- Jun 29, 2026 — CVE-2026-56290 is published (CVSS 4.0 10.0). Version 3.6.1 hardens the Google Fonts manager and AJAX requests.
- Jul 7, 2026 — CISA adds CVE-2026-56290 to KEV.
- Jul 10, 2026 — CISA's federal remediation deadline. CSA Singapore issues its alert.
- Jul 21, 2026 — Version 3.6.3 adds media manager upload authorization. CVE-2026-63048 is published the next day.
- Aug 17, 2026 — Version 3.6.5 fixes the styles SQL injection, and CVE-2026-74254 is published.
- Oct 19, 2026 — Version 3.6.7 is released and is the current version.

## Sources

1. [Joomlack — Page Builder CK product page and changelog](https://www.joomlack.fr/en/joomla-extensions/page-builder-ck)
2. [CVE record — CVE-2026-56290](https://www.cve.org/CVERecord?id=CVE-2026-56290)
3. [NVD — CVE-2026-56290](https://nvd.nist.gov/vuln/detail/CVE-2026-56290)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-56290](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290)
5. [Joomlack forum — Nouvelle version de pbck et joomla 3 (patched Joomla 3/4 builds)](https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3)
6. [mySites.guru — PageBuilder CK unauthenticated file upload RCE (CVE-2026-56290)](https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/)
7. [CVE record — CVE-2026-63048 (Page Builder CK authenticated file upload)](https://www.cve.org/CVERecord?id=CVE-2026-63048)
8. [CVE record — CVE-2026-74254 (Page Builder CK SQL injection)](https://www.cve.org/CVERecord?id=CVE-2026-74254)
9. [Beazley Security Labs — BSL-A1187: Multiple Joomla extension vulnerabilities added to CISA KEV](https://labs.beazley.security/advisories/BSL-A1187)
10. [Cyber Security Agency of Singapore — AL-2026-085: Active exploitation of critical vulnerabilities in Joomla extensions](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-085/)

---
Source page: https://erroneo.us/security/briefs/joomlack-page-builder-ck-cve-2026-56290-file-upload-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt