CVE-2026-39292: PHPPageBuilder File Upload RCE Vulnerability

CVE-2026-39292 Overview

CVE-2026-39292 is an unrestricted file upload vulnerability in Falco Solutions PHPPageBuilder v0.31.0. The flaw resides in the pagemanager/pagebuilder module, which fails to validate uploaded file types and executable content. Remote attackers can upload arbitrary files, including PHP scripts, and achieve remote code execution on the underlying web server. The vulnerability is categorized under [CWE-434] Unrestricted Upload of File with Dangerous Type. No authentication or user interaction is required to exploit the issue across the network. The flaw has an EPSS probability of 0.298% (53.47 percentile) as of 2026-06-04.

Critical Impact

Unauthenticated remote attackers can upload PHP files through pagemanager/pagebuilder and execute arbitrary code in the web server context.

Affected Products

• Falco Solutions PHPPageBuilder v0.31.0
• pagemanager/pagebuilder module (vulnerable component)
• Web applications integrating the affected PHPPageBuilder release

Discovery Timeline

• 2026-05-29 - CVE-2026-39292 published to NVD
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-39292

Vulnerability Analysis

The vulnerability is an unrestricted file upload flaw in the pagemanager/pagebuilder module of PHPPageBuilder v0.31.0. The upload handler accepts arbitrary file types because it does not enforce server-side validation on file extension, MIME type, or content signature. An attacker can submit a request containing a PHP payload disguised as a legitimate asset such as an image or template fragment.

Once the file is written into a web-accessible directory, the attacker requests its URL and the PHP interpreter executes the payload. This grants code execution under the privileges of the web server process. From that position, an attacker can read application secrets, pivot to the database, or deploy a persistent web shell.

Root Cause

The root cause is missing or insufficient validation in the upload routine inside the pagemanager/pagebuilder component. The module trusts client-supplied metadata and stores uploaded content in a directory served by the PHP runtime. Without an allowlist of safe extensions, content-type verification, or rewriting of executable suffixes, any uploaded .php file remains executable.

Attack Vector

Exploitation is performed over the network against the exposed PHPPageBuilder endpoint. The attacker crafts an HTTP POST request to the page builder upload handler with a PHP file as the payload body. After upload, the attacker issues a GET request to the stored file path to trigger execution. Refer to the GitHub Proof of Concept for CVE-2026-39292 and the PHPageBuilder source repository for technical details on the affected request flow.

Detection Methods for CVE-2026-39292

Indicators of Compromise

• Newly created .php, .phtml, or .phar files within PHPPageBuilder upload directories such as those used by the pagemanager/pagebuilder module.
• HTTP POST requests to page builder upload endpoints with Content-Type: multipart/form-data originating from untrusted IP addresses.
• Web server access logs showing GET requests to recently uploaded files in asset or template directories.
• Outbound network connections initiated by the PHP-FPM or Apache process to attacker-controlled hosts.

Detection Strategies

• Monitor file system events on web roots for creation of executable PHP files outside the application install process.
• Inspect HTTP request bodies destined for pagemanager/pagebuilder endpoints for PHP tags such as <?php or <?=.
• Correlate upload events with subsequent execution requests to the same file path within a short time window.

Monitoring Recommendations

• Enable verbose web server logging for the PHPPageBuilder admin and upload routes, retaining request bodies where policy allows.
• Forward web server, PHP error, and file integrity events to a centralized SIEM for correlation.
• Alert on web server processes spawning shells, curl, wget, or other interpreters indicative of post-exploitation activity.

How to Mitigate CVE-2026-39292

Immediate Actions Required

• Restrict access to the pagemanager/pagebuilder interface using network ACLs, VPN, or authentication proxies until a patched release is deployed.
• Audit the upload directories for unexpected .php, .phtml, .phar, or .htaccess files and remove unauthorized artifacts.
• Rotate any credentials, API keys, and session secrets that were accessible to the web application process.
• Review web server and application logs for prior exploitation attempts dating back to the deployment of v0.31.0.

Patch Information

No official vendor patch is referenced in the NVD entry at publication. Track the PHPageBuilder GitHub repository for upstream fixes and updated releases addressing CVE-2026-39292.

Workarounds

• Configure the web server to deny PHP execution within upload and asset directories, for example by disabling the PHP handler with php_admin_flag engine off or equivalent.
• Enforce an extension allowlist at a reverse proxy or web application firewall, blocking uploads of .php, .phtml, .phar, .pht, and .htaccess.
• Store uploaded files outside the web root and serve them through a controlled script that sets non-executable content types.
• Apply least privilege to the web server account so a successful upload cannot modify application code or system binaries.

# Example Apache configuration to block PHP execution in upload paths
<Directory "/var/www/phpagebuilder/uploads">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar|pht)$">
        Require all denied
    </FilesMatch>
</Directory>