Skip to content
OpenAdvisories
Critical · 10.0 Known exploited Scanner template Public exploit CVE-2026-56290 EUVD-2026-40121GHSA-gxrr-wfg5-xqqf

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0

Published Jun 29, 2026 · Updated Oct 8, 2026 · Assigned by Joomla

Vendor: joomlack.fr Product: JoomlaCK.fr Page Builder CK extension for Joomla Category: Web / CMS

Description

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

Affected products

VendorProductAffectedFixed
joomlack.fr JoomlaCK.fr Page Builder CK extension for Joomla 1.0-3.6.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 6 repositories

  • Jenderal92/CVE-2026-56290 ★ 5 · Jul 8, 2026

    CVE-2026-56290 - Mass Exploit for Joomla Com_pagebuilderck component (Unrestricted File Upload → RCE). Multi-threaded, automatic CSRF bypass, PHP shell uploader.

  • shinthink/pbck-exploit ★ 3 · Jul 4, 2026

    📤 Mass exploitation framework for CVE-2026-56290 — Page Builder CK Joomla unauthenticated file upload to RCE

  • sagsooz/PageBuilderCK-CVE-2026-56290-Exploit ★ 2 · Jul 3, 2026

    Page Builder CK for Joomla - Unauthenticated SSRF / Remote File Write leading to PHP execution Exploiter

  • Mushr00w/CVE-2026-56290 ★ 0 · Nov 12, 2026

    Exploit for CVE-2026-56290 - Joomla Page Builder CK <= 3.5.10 Unauthenticated RCE. For educational and authorized security testing only.

  • katranSefa/CVE-2026-56290 ★ 0 · Sep 5, 2026
  • ChiefYoru/CVE-2026-56290_PoC ★ 0 · Jul 19, 2026

    The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References