CVE-2026-56290

Name of the Vulnerable Software and Affected Versions Page Builder CK extension for Joomla versions prior to 3.6.0

Description The Page Builder CK extension for Joomla contains an unauthenticated arbitrary file upload flaw. The issue stems from improper input validation and insufficient server-side restrictions on uploaded file paths and types, allowing attackers to upload executable files, such as PHP webshells, directly to the web server. By requesting these uploaded files over HTTP, a remote attacker can achieve full remote code execution (RCE) in the context of the web server, potentially leading to complete site takeover and data theft. The flaw affects multiple CKEditor upload endpoints.

Recommendations Update Page Builder CK extension for Joomla to version 3.6.0 or later.