CVE-2026-56290

CRITICAL

CVE: CVE-2026-56290 - Joomla Extension - joomlackSign in to save

Exploited in the wild

CVSS

9.8

CVSS v3.1

EPSS

83.3%

Exploit Prediction Score

Published

June 29, 2026

Exploitability

Exploited in the wild (CISA KEV)

Description

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

Weaknesses

CWE-434

Affected Packages

No package data available.

Aliases

CVE-2026-56290

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://www.joomlack.fr/
https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3
https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290