/Vulnerability Library

Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload

CVE-2026-56290
Verified

Description

Joomla Page Builder CK contains an unrestricted file upload vulnerability caused by lack of proper validation, letting unauthenticated attackers upload executable files and achieve remote code execution.

Severity

Critical

CVSS Score

9.8

Exploit Probability

31%

Affected Product

page_builder_ck

Published Date

July 11, 2026

Template Author

panchiko-p, 0x_akoko

CVE-2026-56290.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-56290
CWE ID:
cwe-434

References

https://nvd.nist.gov/vuln/detail/CVE-2026-56290https://cxsecurity.com/issue/WLB-2026070010https://www.exploit-db.com/exploits/52626https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Remediation Steps

Update to the latest version of Page Builder CK.