{"schema":"vulnpedia.research/1","cve":"CVE-2026-56290","references":[{"url":"https://www.joomlack.fr/","tags":["product","Product"],"source":"mitre","sourceId":"Joomla","modified":"2026-10-08T04:47:28.097Z","origins":[{"source":"mitre","sourceId":"Joomla","modified":"2026-10-08T04:47:28.097Z","url":"https://www.joomlack.fr/"},{"source":"nvd","sourceId":"CVE-2026-56290","modified":"2026-10-25T21:10:00.770","url":"https://www.joomlack.fr/"}]},{"url":"https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/","tags":["third-party-advisory","Exploit","Third Party Advisory","KEV report"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-07T18:14:05.009Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-07T18:14:05.009Z","url":"https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/"},{"source":"nvd","sourceId":"CVE-2026-56290","modified":"2026-10-25T21:10:00.770","url":"https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","modified":"2026-06-27T00:00:00Z","url":"https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/"}]},{"url":"https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3","tags":["patch","Issue Tracking","Patch"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-07T18:14:05.009Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-07T18:14:05.009Z","url":"https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3"},{"source":"nvd","sourceId":"CVE-2026-56290","modified":"2026-10-25T21:10:00.770","url":"https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-07T18:14:05.009Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-07T18:14:05.009Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290"},{"source":"nvd","sourceId":"CVE-2026-56290","modified":"2026-10-25T21:10:00.770","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290"}]},{"source":"euvd","sourceId":"EUVD-2026-40121","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40121","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-40121","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40121"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-56290","modified":"2026-06-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","modified":"2026-06-27T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://previdian.com/CVE-2026-56290","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-56290","modified":"2026-06-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","modified":"2026-06-27T00:00:00Z","url":"https://previdian.com/CVE-2026-56290"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-56290","modified":"2026-06-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","modified":"2026-06-27T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://www.recordedfuture.com/blog/july-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-56290","modified":"2026-06-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","modified":"2026-06-27T00:00:00Z","url":"https://www.recordedfuture.com/blog/july-2026-cve-landscape"}]},{"url":"https://www.acn.gov.it/portale/documents/20119/1300791/Operational_Summary_lug26_CLEAR.pdf/88b05799-3e4c-f3ed-4a42-d9e68e080604?t=1787220905144","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-56290","modified":"2026-06-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","modified":"2026-06-27T00:00:00Z","url":"https://www.acn.gov.it/portale/documents/20119/1300791/Operational_Summary_lug26_CLEAR.pdf/88b05799-3e4c-f3ed-4a42-d9e68e080604?t=1787220905144"}]},{"url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-56290&date=2026-10-22","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-56290","modified":"2026-06-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","modified":"2026-06-27T00:00:00Z","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-56290&date=2026-10-22"}]},{"url":"https://vulncheck.com/xdb/1e34893b8b9a","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"1e34893b8b9a","modified":"2026-06-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"1e34893b8b9a","modified":"2026-06-27T00:00:00Z","url":"https://vulncheck.com/xdb/1e34893b8b9a"}]},{"url":"https://github.com/shinthink/pbck-exploit","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"1e34893b8b9a","modified":"2026-06-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"1e34893b8b9a","modified":"2026-06-27T00:00:00Z","url":"https://github.com/shinthink/pbck-exploit"}]},{"url":"https://vulncheck.com/xdb/0729778835c6","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"0729778835c6","modified":"2026-06-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"0729778835c6","modified":"2026-06-27T00:00:00Z","url":"https://vulncheck.com/xdb/0729778835c6"}]},{"url":"https://github.com/Jenderal92/CVE-2026-56290","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"0729778835c6","modified":"2026-06-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"0729778835c6","modified":"2026-06-27T00:00:00Z","url":"https://github.com/Jenderal92/CVE-2026-56290"}]},{"url":"https://vulncheck.com/xdb/8d90489e52a0","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"8d90489e52a0","modified":"2026-06-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"8d90489e52a0","modified":"2026-06-27T00:00:00Z","url":"https://vulncheck.com/xdb/8d90489e52a0"}]},{"url":"https://github.com/katranSefa/CVE-2026-56290","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"8d90489e52a0","modified":"2026-06-27T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"8d90489e52a0","modified":"2026-06-27T00:00:00Z","url":"https://github.com/katranSefa/CVE-2026-56290"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit","source":"poc-in-github","sourceId":"CVE-2026-56290","description":"Page Builder CK for Joomla - Unauthenticated SSRF / Remote File Write leading to PHP execution Exploiter","modified":"2026-07-16T08:36:49Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-56290","url":"https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit"},{"source":"poc-in-github","sourceId":"CVE-2026-56290","modified":"2026-07-16T08:36:49Z","url":"https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit"}],"tags":[]},{"url":"https://github.com/shinthink/pbck-exploit","source":"poc-in-github","sourceId":"CVE-2026-56290","description":"📤 Mass exploitation framework for CVE-2026-56290 — Page Builder CK Joomla unauthenticated file upload to RCE","modified":"2026-07-10T08:02:16Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-56290","url":"https://github.com/shinthink/pbck-exploit"},{"source":"poc-in-github","sourceId":"CVE-2026-56290","modified":"2026-07-10T08:02:16Z","url":"https://github.com/shinthink/pbck-exploit"}],"tags":[]},{"url":"https://github.com/Jenderal92/CVE-2026-56290","source":"poc-in-github","sourceId":"CVE-2026-56290","description":"CVE-2026-56290 - Mass Exploit for Joomla Com_pagebuilderck component (Unrestricted File Upload → RCE). Multi-threaded, automatic CSRF bypass, PHP shell uploader.","modified":"2026-08-22T10:19:38Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-56290","url":"https://github.com/Jenderal92/CVE-2026-56290"},{"source":"poc-in-github","sourceId":"CVE-2026-56290","modified":"2026-08-22T10:19:38Z","url":"https://github.com/Jenderal92/CVE-2026-56290"}],"tags":[]},{"url":"https://github.com/ChiefYoru/CVE-2026-56290_PoC","source":"poc-in-github","sourceId":"CVE-2026-56290","description":"The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.","modified":"2026-07-19T08:07:57Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-56290","url":"https://github.com/ChiefYoru/CVE-2026-56290_PoC"},{"source":"poc-in-github","sourceId":"CVE-2026-56290","modified":"2026-07-19T08:07:57Z","url":"https://github.com/ChiefYoru/CVE-2026-56290_PoC"}],"tags":[]},{"url":"https://github.com/katranSefa/CVE-2026-56290","source":"poc-in-github","sourceId":"CVE-2026-56290","modified":"2026-09-05T10:35:44Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-56290","url":"https://github.com/katranSefa/CVE-2026-56290"},{"source":"poc-in-github","sourceId":"CVE-2026-56290","modified":"2026-09-05T10:35:44Z","url":"https://github.com/katranSefa/CVE-2026-56290"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"1e34893b8b9a","url":"https://vulncheck.com/xdb/1e34893b8b9a","cve":"CVE-2026-56290","dateAdded":"2026-07-06T12:14:40Z","modified":"2026-06-27T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/shinthink/pbck-exploit","observations":[{"dateAdded":"2026-07-06T12:14:40Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"1e34893b8b9a","modified":"2026-06-27T00:00:00Z","url":"https://vulncheck.com/xdb/1e34893b8b9a"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"0729778835c6","url":"https://vulncheck.com/xdb/0729778835c6","cve":"CVE-2026-56290","dateAdded":"2026-07-08T14:51:09Z","modified":"2026-06-27T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/Jenderal92/CVE-2026-56290","observations":[{"dateAdded":"2026-07-08T14:51:09Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"0729778835c6","modified":"2026-06-27T00:00:00Z","url":"https://vulncheck.com/xdb/0729778835c6"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"8d90489e52a0","url":"https://vulncheck.com/xdb/8d90489e52a0","cve":"CVE-2026-56290","dateAdded":"2026-09-05T10:35:27Z","modified":"2026-06-27T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/katranSefa/CVE-2026-56290","observations":[{"dateAdded":"2026-09-05T10:35:27Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"8d90489e52a0","modified":"2026-06-27T00:00:00Z","url":"https://vulncheck.com/xdb/8d90489e52a0"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-06-27T00:00:00Z","modified":"2026-06-27T00:00:00Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":true,"vendorProject":"Joomlack","product":"Page Builder","dueDate":"2026-07-10T00:00:00Z","cisaDateAdded":"2026-07-07T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","modified":"2026-06-27T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","catalog":"VulnCheck KEV","kind":"report","url":"https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/","dateAdded":"2026-06-27T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","url":"https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","catalog":"VulnCheck KEV","kind":"report","url":"https://previdian.com/CVE-2026-56290","dateAdded":"2026-07-07T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","url":"https://previdian.com/CVE-2026-56290"},{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","catalog":"VulnCheck KEV","kind":"report","url":"https://www.recordedfuture.com/blog/july-2026-cve-landscape","dateAdded":"2026-08-07T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","url":"https://www.recordedfuture.com/blog/july-2026-cve-landscape"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","catalog":"VulnCheck KEV","kind":"report","url":"https://www.acn.gov.it/portale/documents/20119/1300791/Operational_Summary_lug26_CLEAR.pdf/88b05799-3e4c-f3ed-4a42-d9e68e080604?t=1787220905144","dateAdded":"2026-08-20T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","url":"https://www.acn.gov.it/portale/documents/20119/1300791/Operational_Summary_lug26_CLEAR.pdf/88b05799-3e4c-f3ed-4a42-d9e68e080604?t=1787220905144"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","catalog":"VulnCheck KEV","kind":"report","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-56290&date=2026-10-22","dateAdded":"2026-10-22T00:00:00Z","firstPartyCanary":true,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-56290","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-56290&date=2026-10-22"}]}]}