{"id":"CVE-2026-56290","published":"2026-06-29T15:16:42Z","modified":"2026-10-25T21:10:00Z","title":"Joomlack Page Builder Improper Access Control Vulnerability","vendor":"Joomlack","product":"Page Builder","tier":"core","eol":null,"description":{"text":"Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.","provenance":"source","from":"NVD"},"summary":{"text":"The Page Builder CK extension for Joomla from Joomlack, in versions before 3.6.0, contains an improper access control flaw that allows arbitrary file uploads without authentication. An attacker who can reach the Joomla site over the network can upload executable files without logging in or any user interaction, which leads to remote code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:02Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.30866,"percentile":0.98252,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2026-07-07","dueDate":"2026-07-10","ransomware":false,"requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://www.joomlack.fr/en/joomla-extensions/page-builder-ck ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56290","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-06-27","exploitedFirstSeen":"2026-06-27","ransomware":false,"evidence":[{"url":"https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/","date":"2026-06-27"},{"url":"https://previdian.com/CVE-2026-56290","date":"2026-07-07"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-07-07"},{"url":"https://www.recordedfuture.com/blog/july-2026-cve-landscape","date":"2026-08-07"},{"url":"https://www.acn.gov.it/portale/documents/20119/1300791/Operational_Summary_lug26_CLEAR.pdf/88b05799-3e4c-f3ed-4a42-d9e68e080604?t=1787220905144","date":"2026-08-20"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"},{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://www.joomlack.fr/","tags":["Product"]},{"url":"https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3","tags":["Issue Tracking","Patch"]},{"url":"https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated upload exploits public-facing web application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"unauthenticated arbitrary file upload that allows uploading executable files","start":157,"end":233}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Uploaded executable files yield remote code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows uploading executable files and leads to full RCE","start":200,"end":255}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-40121","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40121","exploited":true,"exploitedSince":"2026-07-07","provenance":"source"},"exploits":[{"id":52626,"url":"https://www.exploit-db.com/exploits/52626","title":"Joomla Page Builder CK  3.5.10 -  Arbitrary File Upload","type":"webapps","platform":"multiple","date":"2026-07-08","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2026-07-08"},"pocGithub":{"count":4,"skipped":1,"earliest":"2026-07-03","earliestUrl":"https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit","repos":[{"name":"Jenderal92/CVE-2026-56290","url":"https://github.com/Jenderal92/CVE-2026-56290","stars":5,"created":"2026-07-08"},{"name":"shinthink/pbck-exploit","url":"https://github.com/shinthink/pbck-exploit","stars":3,"created":"2026-07-04"},{"name":"sagsooz/PageBuilderCK-CVE-2026-56290-Exploit","url":"https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit","stars":2,"created":"2026-07-03"},{"name":"ChiefYoru/CVE-2026-56290_PoC","url":"https://github.com/ChiefYoru/CVE-2026-56290_PoC","stars":0,"created":"2026-07-19"}]},"nuclei":[{"id":"CVE-2026-56290","name":"Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload","severity":"critical","path":"http/cves/2026/CVE-2026-56290.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56290.yaml"}],"first":{"date":"2026-07-03","source":"PoC-in-GitHub","url":"https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit"},"provenance":"source"},"exploitRefs":["https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2026-06-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/","provenance":"source"},{"date":"2026-06-29","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56290","provenance":"source"},{"date":"2026-07-03","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2026-07-08","url":"https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit","provenance":"source"},{"date":"2026-07-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-07-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40121","provenance":"source"}],"speed":{"daysToPublicExploit":4,"firstExploitFrom":"PoC-in-GitHub","daysToKev":8},"priority":{"score":71.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 127 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.65,"detail":"percentile 0.9825"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 4 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}