VULNERABILITY INTELLIGENCE

CVE-2026-56290

CVSS score9.8 CRITICAL

EPSS probability30.87%

CISA KEVKnown exploited vulnerability

Published2026-06-29

Last modified2026-10-25

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Joomlack Page Builder Improper Access Control Vulnerability

Vendor / product: Joomlack / Page Builder

Description

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

Weakness classification

security@joomla.org: CWE-434
nvd@nist.gov: CWE-434

Primary references

security@joomla.org — Product
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Issue Tracking, Patch
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource