Intel

CVE-2026-56290

Joomlack Page Builder — Joomlack Page Builder Improper Access Control Vulnerability

criticalKEV: actively exploitedPoCEPSS 30%

Description

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

Source: CISA_KEVNVDCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2026-56290 scores CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), meaning a single unauthenticated HTTP POST request can result in full server compromise — no credentials, no user interaction, and no complex preconditions required. The EPSS score of 30.4 % at the 98.1st percentile places this firmly in the highest-risk tier for near-term exploitation. Any NIS2-scoped organisation running a publicly reachable Joomla instance with Page Builder CK < 3.6.0 has a directly internet-exposed critical attack surface that must be patched before any other remediation work. Although CISA has not flagged known ransomware campaign use, a successfully placed webshell provides full server control and is a standard pivot point for lateral movement and data exfiltration — both of which trigger GDPR breach-notification obligations under NIS2 Article 23.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch immediately: Upgrade Page Builder CK to version 3.6.0 or later via the Joomla Extension Manager (verify the installed version in the backend before and after). All instances running < 3.6.0 are exploitable without authentication.
  • Disable PHP execution in upload directories: Block server-side execution of PHP in all Joomla upload paths (/images/, /media/, /tmp/, and extension-specific paths under /components/com_pagebuilderck/). Apache: add php_flag engine off via .htaccess; Nginx: add a location block returning 403 for *.php within those paths.
  • Review web server logs for signs of compromise: Search all POST requests to the extension's upload endpoint (typically index.php?option=com_pagebuilderck&task=upload*) for responses with HTTP 200 and uploaded files carrying executable extensions (.php, .phtml, .php5, .phar). Look back at least 30 days.
  • Scan the filesystem for dropped webshells: Run find /var/www -name "*.php" -newer /var/www/html/configuration.php -ls across all Joomla installations. Quarantine suspicious files for forensic analysis — do not delete before imaging.
  • Restrict access to upload endpoints: Until the patch is fully rolled out, block public access to the upload endpoint via WAF or reverse-proxy ACL; limit Joomla backend access (ports 80/443, path /administrator/) to known IP ranges.

Runbook · Step 2

Mitigation layers

  • WAF rule (network layer): Block or restrict HTTP POST requests matching option=com_pagebuilderck combined with task=upload. ModSecurity example: SecRule REQUEST_URI "@contains com_pagebuilderck" "id:9001,phase:2,deny,status:403,msg:'CVE-2026-56290 Upload Block'".
  • Prevent webshell execution (endpoint hardening): Even if a file is uploaded successfully, deny its execution. Nginx: location ~* ^/components/com_pagebuilderck/.*\.php$ { deny all; }. This is a critical compensating control if patching is delayed.
  • Server-side file-type validation: Configure the upload handler to accept only explicitly allowed MIME types (e.g. image/jpeg, image/png). Server-side validation must not rely solely on client-supplied Content-Type headers.
  • Least-privilege for the web server process: Ensure the web server user cannot create executable files in upload directories. Enforce noexec mount options on /tmp and upload paths; review AppArmor/SELinux profiles to restrict write permissions.
  • Egress filtering (network segmentation): Place the Joomla server in a DMZ and restrict outbound connections from the web server host to known destinations. This limits the usefulness of a dropped webshell for C2 callbacks or lateral movement.
  • Rotate credentials and enforce MFA: Force rotation of all Joomla administrator session tokens post-patch; enforce multi-factor authentication on all admin accounts, as pre-patch compromise cannot be ruled out.

Runbook · Step 3

Detection rules

  • Web server access logs (Apache/Nginx): Pattern POST .*(com_pagebuilderck).*(upload) with HTTP 200 and response body or Content-Type indicating a PHP file. SPL: index=web method=POST uri="*com_pagebuilderck*upload*" status=200 | stats count by src_ip, uri.
  • Filesystem monitoring (auditd/Sysmon): Alert on new .php, .phtml, or .phar files created in Joomla upload directories. auditd rule: -w /var/www/html/images -p wa -k joomla_upload_write; Sysmon EID 11 (FileCreate) filtering on paths *\images\* or *\components\com_pagebuilderck\* with extension .php.
  • Process ancestry (EDR): Web server or PHP-FPM process (apache2, nginx, php-fpm) spawning shell or network utilities (/bin/sh, bash, curl, wget, nc). Sigma shape: ParentImage|endswith: 'php-fpm' AND Image|endswith: ('/sh', '/bash', '/curl').
  • Network telemetry (Zeek/Suricata): Outbound connections from the web server host to unknown external IPs following a POST upload event. Suricata rule: alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"CVE-2026-56290 Possible Webshell Callback"; content:"com_pagebuilderck"; content:"upload"; sid:2026562901;).
  • Joomla application log: Upload requests to com_pagebuilderck without a valid Joomla session token or with an empty user context. KQL: event.dataset:"joomla.access" AND url.query:"com_pagebuilderck" AND NOT user.name:*.

Metrics

Severity
critical
Priority score
234.17
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
10.0
Source: nvd-v4
CVSS v3
9.8
CVSS v4
10.0
EPSS percentile
98.1 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
30.4 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2026-07-07 00:00 UTC
CWE
CWE-434

Weakness classes (CWE)

  • CWE-434Base

    Unrestricted Upload of File with Dangerous Type

    The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Modified Analysis2026-07-24 13:31 UTC· nvd@nist.gov
  2. CVE Modified2026-07-23 16:17 UTC· security@joomla.org
    • Description: The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE. → Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
  3. CVE Modified2026-07-08 05:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-56290","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technic… → {"id":"CVE-2026-56290","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technic…
  4. CVE Modified2026-07-05 15:16 UTC· security@joomla.org
    • CWE: CWE-434
    • CWE: CWE-284
  5. Initial Analysis2026-07-02 18:53 UTC· nvd@nist.gov
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    • CWE: CWE-434
    • CPE Configuration: OR *cpe:2.3:a:joomlack:page_builder_ck:*:*:*:*:*:joomla!:*:* versions up to (including) 3.6.0
    • Reference Type: Joomla! Project: https://www.joomlack.fr/ Types: Product

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • joomlack

    page_builder_ck3.6.0

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked advisories

IDCVE-2026-56290