Joomla Page Builder CK Extension Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2026-56290)

1. Apply Official Security Patch

Immediately upgrade the extension to the patched version released by the vendor.

• Recommended Version: Page Builder CK 3.6.0 or higher
• Update via the Joomla Administrator backend under 'Extensions: Update' or download the latest package from the official site.

2. Temporary Mitigation (If patching cannot be applied immediately)

A. Web Application Firewall (WAF) Rule

Deploy a WAF rule to block multipart/form-data requests containing executable extensions targeting the Page Builder CK directories.

# Nginx / WAF pseudo-code example
location ~* /media/com_pagebuilderck/.*\.php$ {
    deny all;
    access_log off;
    log_not_found off;
}

B. Disable Execution in Upload Directories

Prevent PHP execution within the media and upload directories used by Page Builder CK.

• Apache (.htaccess):

<Directory "/your-joomla-path/images/pagebuilderck">
    <FilesMatch "\.(php|pl|py|jsp|asp|sh|cgi)$">
        ForceType text/plain
        Deny from all
    </FilesMatch>
</Directory>

A critical security vulnerability has been identified in Page Builder CK, a popular page builder extension for Joomla. This vulnerability (CVE-2026-56290) has received a maximum CVSS score of 9.8 (Critical) and is actively exploited in the wild, leading to its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Root Cause & Attack Mechanics (CWE-434)

The vulnerability stems from a lack of authentication checks and insufficient file validation within the extension's file upload functionality.

• Unauthenticated Access: Attackers can directly access the file upload endpoint without requiring any administrative or user credentials.
• Validation Bypass: The application fails to restrict uploaded file extensions or verify MIME types properly, allowing malicious PHP scripts (webshells) to be written directly to the web root.
• Remote Code Execution: Once uploaded, the attacker can trigger the payload by sending a direct HTTP request to the file path, executing arbitrary system commands under the context of the web server process.

Due to the low attack complexity (AC:L) and high exploitability (EPSS: 0.94), immediate remediation is highly recommended.