CVE-2026-56290
CRITICAL 10 KNOWN EXPLOITED PoC CATALOGUED DETECTION TEMPLATE ALL-YEARSJoomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
Confirmed exploited in the wild — in CISA KEV since 2026-07-07. Patch or mitigate now.
Exploitation likelihood
30.9%chance of exploitation in 30 days · 98th percentile
Impact if exploited
10CVSS 4.0 · CRITICAL · CNA
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
Public PoC or exploit resources are catalogued below.
- VulnCheck KEV · XDB 1e34893b8b9a · Linked repository
- VulnCheck KEV · XDB 0729778835c6 · Linked repository
- VulnCheck KEV · XDB 8d90489e52a0 · Linked repository
- ExploitDB #52626
Listed by the named source; Vulnpedia has not tested these resources.
PoC data: JSON
Detection templates
Detection checks are listed separately from PoCs.
Resource commands
nuclei -id CVE-2026-56290 -u https://TARGETDetection template — review its checks and affected versions before use.searchsploit --cve CVE-2026-56290 && searchsploit -m 52626Fetch the ExploitDB PoC locally; review the code before running it.curl -s https://vulnpedia.com/cve/CVE-2026-56290/poc.jsonMachine-readable PoC index for this CVE (for automation).Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Affected
Vendors Joomlack.Fr Joomlack
Products Joomlack.Fr Page Builder Ck Extension For Joomla Page Builder Ck
Weakness (CWE)
- CWE-434: : Unrestricted Upload of File with Dangerous Type
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
References and research data (JSON)
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
5 candidates
- https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit
Page Builder CK for Joomla - Unauthenticated SSRF / Remote File Write leading to PHP execution Exploiter
PoC-in-GitHub · CVE-2026-56290
PoC-in-GitHub · CVE-2026-56290 · Updated 2026-07-16T08:36:49Z - https://github.com/shinthink/pbck-exploit
📤 Mass exploitation framework for CVE-2026-56290 — Page Builder CK Joomla unauthenticated file upload to RCE
PoC-in-GitHub · CVE-2026-56290
PoC-in-GitHub · CVE-2026-56290 · Updated 2026-07-10T08:02:16Z - https://github.com/Jenderal92/CVE-2026-56290
CVE-2026-56290 - Mass Exploit for Joomla Com_pagebuilderck component (Unrestricted File Upload → RCE). Multi-threaded, automatic CSRF bypass, PHP shell uploader.
PoC-in-GitHub · CVE-2026-56290
PoC-in-GitHub · CVE-2026-56290 · Updated 2026-08-22T10:19:38Z - https://github.com/ChiefYoru/CVE-2026-56290_PoC
The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
PoC-in-GitHub · CVE-2026-56290
PoC-in-GitHub · CVE-2026-56290 · Updated 2026-07-19T08:07:57Z - https://github.com/katranSefa/CVE-2026-56290PoC-in-GitHub · CVE-2026-56290
PoC-in-GitHub · CVE-2026-56290 · Updated 2026-09-05T10:35:44Z
Additional exploitation reports
Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.
- VulnCheck KEV · 2026-06-27T00:00:00Z
Source guidance: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source ransomware assessment: Unknown
VulnCheck KEV · CVE-2026-56290 · Updated 2026-06-27T00:00:00Z - VulnCheck KEV · 2026-06-27T00:00:00ZVulnCheck KEV · CVE-2026-56290
- VulnCheck KEV · 2026-07-07T00:00:00ZVulnCheck KEV · CVE-2026-56290
VulnCheck KEV · CVE-2026-56290 - VulnCheck KEV · 2026-08-07T00:00:00ZVulnCheck KEV · CVE-2026-56290
- VulnCheck KEV · 2026-08-20T00:00:00ZVulnCheck KEV · CVE-2026-56290
- VulnCheck KEV · 2026-10-22T00:00:00ZVulnCheck KEV · CVE-2026-56290
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Joomlack | Page Builder Ck | < 3.6.0 |
All CVSS metrics
- CRITICAL 10 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red - CRITICAL 10 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red - CRITICAL 9.8 v3.1 · NVD Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Exploit-tagged references (not proof of a PoC)
- https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/ CVE record · CISA-ADP · Updated 2026-10-07T18:14:05.009Z
NVD · CVE-2026-56290 · Updated 2026-10-25T21:10:00.770
VulnCheck KEV · CVE-2026-56290 · Updated 2026-06-27T00:00:00Z
Patches & mitigations
- https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3 CVE record · CISA-ADP · Updated 2026-10-07T18:14:05.009Z
NVD · CVE-2026-56290 · Updated 2026-10-25T21:10:00.770
Advisories
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290 CVE record · CISA-ADP · Updated 2026-10-07T18:14:05.009Z
NVD · CVE-2026-56290 · Updated 2026-10-25T21:10:00.770 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40121 EUVD · EUVD-2026-40121
- https://vulncheck.com/kev VulnCheck KEV · CVE-2026-56290 · Updated 2026-06-27T00:00:00Z
Technical & other
- https://www.joomlack.fr/ CVE record · Joomla · Updated 2026-10-08T04:47:28.097Z
NVD · CVE-2026-56290 · Updated 2026-10-25T21:10:00.770 - https://previdian.com/CVE-2026-56290 VulnCheck KEV · CVE-2026-56290 · Updated 2026-06-27T00:00:00Z
- https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json VulnCheck KEV · CVE-2026-56290 · Updated 2026-06-27T00:00:00Z
- https://www.recordedfuture.com/blog/july-2026-cve-landscape VulnCheck KEV · CVE-2026-56290 · Updated 2026-06-27T00:00:00Z
- https://www.acn.gov.it/portale/documents/20119/1300791/Operational_Summary_lug26_CLEAR.pdf/88b05799-3e4c-f3ed-4a42-d9e68e080604?t=1787220905144 VulnCheck KEV · CVE-2026-56290 · Updated 2026-06-27T00:00:00Z
- https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-56290&date=2026-10-22 VulnCheck KEV · CVE-2026-56290 · Updated 2026-06-27T00:00:00Z
- https://vulncheck.com/xdb/1e34893b8b9a VulnCheck KEV · 1e34893b8b9a · Updated 2026-06-27T00:00:00Z
- https://github.com/shinthink/pbck-exploit VulnCheck KEV · 1e34893b8b9a · Updated 2026-06-27T00:00:00Z
- https://vulncheck.com/xdb/0729778835c6 VulnCheck KEV · 0729778835c6 · Updated 2026-06-27T00:00:00Z
- https://github.com/Jenderal92/CVE-2026-56290 VulnCheck KEV · 0729778835c6 · Updated 2026-06-27T00:00:00Z
- https://vulncheck.com/xdb/8d90489e52a0 VulnCheck KEV · 8d90489e52a0 · Updated 2026-06-27T00:00:00Z
- https://github.com/katranSefa/CVE-2026-56290 VulnCheck KEV · 8d90489e52a0 · Updated 2026-06-27T00:00:00Z
Sources: NVD · CVE.org · All sources and attribution · EPSS