CVE-2026-56290
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
| CWE | CWE-434 |
| Vendor | joomlack.fr |
| Product | joomlack.fr page builder ck extension for joomla |
| Published | Jun 29, 2026 |
| Last Updated | Aug 12, 2026 |
⚠️ Actively Exploited — Act Now
Get instant alerts for joomlack.fr joomlack.fr page builder ck extension for joomla
This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2026-56290.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
joomlack.fr / JoomlaCK.fr Page Builder CK extension for Joomla
1.0-3.6.0
References
joomlack.fr: https://www.joomlack.fr/ mysites.guru: https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/ forum.joomlack.fr: https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3 cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290
Credits
Phil Taylor, mysites.guru