CVE-2026-56290: Joomlack Page Builder Ck RCE Vulnerability

CVE-2026-56290 Overview

CVE-2026-56290 is an unauthenticated arbitrary file upload vulnerability in the Page Builder CK extension for Joomla, developed by Joomlack. The flaw allows remote attackers to upload executable files without any authentication, resulting in full remote code execution (RCE) on the underlying web server. The vulnerability is tracked under [CWE-434] Unrestricted Upload of File with Dangerous Type and [CWE-284] Improper Access Control. Any Joomla site running a vulnerable version of Page Builder CK is exposed to complete compromise through a single HTTP request.

Critical Impact
Unauthenticated attackers can upload web shells and achieve full remote code execution on affected Joomla installations, leading to complete site takeover and potential lateral movement into the hosting environment.

Affected Products

Joomlack Page Builder CK (Joomla extension)
Joomla sites with Page Builder CK installed and reachable from the network
CPE: cpe:2.3:a:joomlack:page_builder_ck:*:*:*:*:*:joomla\!:*:*

Discovery Timeline

2026-06-29 - CVE-2026-56290 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-56290

Vulnerability Analysis

The vulnerability resides in the file upload handler exposed by the Page Builder CK Joomla extension. The endpoint accepts file uploads without validating the requester's authentication state and without enforcing an allowlist on the uploaded file type or extension. An attacker can send a crafted multipart HTTP request containing a PHP payload and place it in a directory served by the web server.

Once written to disk, the attacker requests the file directly. The PHP interpreter executes the payload under the privileges of the web server user, yielding arbitrary command execution. Because no session, token, or administrative credential is required, this vulnerability is exploitable by any network-reachable client.

The combination of missing access control (CWE-284) with unrestricted file type acceptance (CWE-434) produces a direct path from anonymous HTTP request to interactive shell on the host. Refer to the MySites Guru Blog Analysis for a detailed technical breakdown.

Root Cause

The upload handler in Page Builder CK fails to enforce two independent controls. First, the endpoint does not verify that the caller holds a valid Joomla administrator session or token. Second, the handler does not restrict uploaded file extensions or MIME types to a safe allowlist. Files with executable server-side extensions such as .php, .phtml, or .phar are written to a location within the web root.

Attack Vector

The attack vector is network-based and requires no user interaction or prior authentication. The attacker sends a single POST request to the vulnerable upload endpoint with an executable payload, then retrieves the uploaded file via a follow-up GET request to trigger execution. See the Joomlack vendor site and the Joomla Forum Post for vendor context.

No verified proof-of-concept code has been released publicly. The vulnerability mechanism is described in prose above; consult the vendor advisory for implementation-specific details.

Detection Methods for CVE-2026-56290

Indicators of Compromise

New files with executable extensions (.php, .phtml, .phar, .pht) appearing under Page Builder CK upload directories or the Joomla images/ and media/ trees.
POST requests to Page Builder CK upload endpoints originating from unauthenticated sessions or unknown IP addresses.
Outbound connections initiated by the php-fpm or apache process to attacker-controlled infrastructure shortly after upload activity.
Web server access logs showing GET requests to recently created PHP files under extension asset directories.

Detection Strategies

Monitor web server logs for POST requests to Page Builder CK handler URLs followed by GET requests to newly created files in the same path.
Deploy web application firewall (WAF) rules that block multipart uploads containing PHP magic bytes or <?php markers to Joomla component endpoints.
File integrity monitoring on the Joomla document root to alert on creation of executable scripts outside of official update windows.

Monitoring Recommendations

Enable verbose access and error logging in Apache or Nginx and forward logs to a centralized SIEM for correlation.
Alert on webserver processes spawning child processes such as sh, bash, nc, curl, wget, or python.
Track Joomla extension inventory and version data to identify hosts running vulnerable Page Builder CK releases.

How to Mitigate CVE-2026-56290

Immediate Actions Required

Update Page Builder CK to the latest version released by Joomlack. Consult the Joomlack Forum announcement for release information.
If a patched version is unavailable, disable or uninstall the Page Builder CK extension until a fix is applied.
Audit the Joomla document root for unauthorized PHP files created since the extension was installed and remove any web shells.
Rotate any credentials, API tokens, or database passwords that were accessible from the compromised host.

Patch Information

Joomlack has communicated updates through the official Joomlack site and the Joomlack forum. Administrators should apply the vendor-provided update to the Page Builder CK extension and verify the installed version through the Joomla extension manager.

Workarounds

Block public access to Page Builder CK upload endpoints at the WAF or reverse proxy layer until patching is complete.
Configure the web server to deny execution of PHP files inside upload and media directories using php_flag engine off or equivalent Nginx location blocks.
Restrict write permissions on upload directories so that only required Joomla processes can create files.

bash

# Nginx: disable PHP execution inside Joomla media/upload directories
location ~* ^/(images|media|tmp)/.*\.(php|phtml|phar|pht)$ {
    deny all;
    return 403;
}

# Apache: place in .htaccess within upload directories
<FilesMatch "\.(php|phtml|phar|pht)$">
    Require all denied
</FilesMatch>