{"id":"CVE-2026-56290","title":"The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.","summary":"The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-284","CWE-434"],"vendor":"joomlack","product":"page_builder_ck","affected":["page_builder_ck <= 3.6.0"],"published":"2026-06-29","updated":"2026-07-02","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56290","references":[{"url":"https://www.joomlack.fr/","label":"security@joomla.org"},{"url":"https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","exploit-available"],"epss":0.30866,"epssPercentile":0.98214,"ingestedAt":"2026-07-03T13:02:28.091Z","kev":true,"exploited":true,"kevDateAdded":"2026-07-07","kevDueDate":"2026-07-10","kevRansomware":false,"exploitAvailable":true,"exploits":{"exploitdb":true,"github":5,"githubRepos":["https://github.com/Jenderal92/CVE-2026-56290","https://github.com/shinthink/pbck-exploit","https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit"],"nuclei":["CVE-2026-56290"],"checkedAt":"2026-09-21T15:29:42.174Z"},"slug":"CVE-2026-56290","body":"## Overview\n\nThe Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.\n\n## Affected\n\n- `page_builder_ck <= 3.6.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"hadal","depthScore":85,"depthScoreParts":{"impact":53.9,"likelihood":6.2,"exploitation":25,"ransomware":0},"changes":[{"seq":179,"id":"CVE-2026-56290","ts":1787603664836,"field":"epss","old":"0.83254","new":"0.30375"},{"seq":94,"id":"CVE-2026-56290","ts":1784920495240,"field":"epss","old":"0.18707","new":"0.83254"},{"seq":76,"id":"CVE-2026-56290","ts":1784747473285,"field":"epss","old":"0.02912","new":"0.18707"},{"seq":61,"id":"CVE-2026-56290","ts":1783623149912,"field":"exploit_available","old":"false","new":"true"},{"seq":59,"id":"CVE-2026-56290","ts":1783533111728,"field":"exploited","old":"false","new":"true"},{"seq":58,"id":"CVE-2026-56290","ts":1783533111728,"field":"kev","old":"false","new":"true"},{"seq":55,"id":"CVE-2026-56290","ts":1783532625218,"field":"exploited","old":"true","new":"false"},{"seq":54,"id":"CVE-2026-56290","ts":1783532625218,"field":"kev","old":"true","new":"false"},{"seq":51,"id":"CVE-2026-56290","ts":1783529208200,"field":"exploited","old":"false","new":"true"},{"seq":50,"id":"CVE-2026-56290","ts":1783529208200,"field":"kev","old":"false","new":"true"}]}