The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload

Page Builder CK is a widely deployed free page-builder extension for Joomla by Cédric Keiflin. The vulnerable endpoint is a front-end file upload handler that accepts POST uploads with no authentication check and no file-extension allowlist — the only gate is a Joomla anti-CSRF token that any anonymous visitor can scrape from the same site's public pages in one request. That means an attacker fetches any page, harvests the token, POSTs a .php payload, and gets a webshell running as the Joomla web user. Affected: Page Builder CK ≤ 3.5.10 on Joomla 4/5. Fixed lines: 3.6.0 (current), 3.4.10 (Joomla 4 back-patch), 3.1.1 (Joomla 3 back-patch), all shipped 27 June 2026.

The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is honest. Some feeds are scoring this a 10.0. Given the CVE is KEV-listed, the exploit is a copy-paste curl one-liner, and the affected component sits on the public internet by definition, there is zero room to argue this down. noisgate concurs at CRITICAL and holds the score.

Why this verdict

• Zero-precondition unauth RCE: attacker needs only HTTP reachability — no credentials, no session, no user click. The CSRF token is not a gate; it is a public string.
• KEV-listed: CISA has evidence of in-the-wild exploitation. That alone overrides any friction argument.
• Role multiplier — public-facing CMS: Page Builder CK by definition lives on internet-exposed web tiers. Successful chain yields webshell → DB creds in configuration.php → Joomla user-table dump → potential pivot into any internal network the web box can reach. Where the box is dual-homed (marketing site inside a corporate VLAN, common in mid-market), blast radius extends to internal fileshares and directory services. The affected component is canonically an internet-exposed role → CRITICAL floor applies.
• Trivially weaponized: exploit is one curl command; already integrated into Nuclei templates and commodity CMS-scanner toolchains within 72 hours.

Why not higher?

CRITICAL is the top severity bucket. Some feeds score 10.0 instead of 9.8; the practical response is identical. There is no operational reason to invent a higher tier.

Why not lower?

No friction factor survives scrutiny. It is unauthenticated, network-reachable, KEV-listed, and trivially exploitable. The only way to downgrade would be to argue the extension has negligible install base, which is contradicted by JED popularity and Shodan Joomla-fleet size.

1. Upgrade Page Builder CK to 3.6.0 / 3.4.10 / 3.1.1 immediately — This is the only real fix. Deploy within hours — KEV-listed overrides the 3-day CRITICAL mitigation SLA. Push via Joomla Extensions Manager or drop the update package on every Joomla instance in the fleet tonight.
2. Block execution of PHP under images/ and media/com_pagebuilderck/ — Add an nginx location ~ ^/(images|media/com_pagebuilderck)/.*\.php$ { deny all; } or Apache <FilesMatch> deny rule. Neutralizes the webshell drop even if the file lands. Ship this in the same change window as the patch as belt-and-suspenders.
3. Deploy a WAF virtual patch — Akeeba Admin Tools, RSFirewall, Cloudflare managed ruleset, and ModSecurity CRS all have signatures for the Page Builder CK upload endpoint by 30 Jun 2026. Enable in blocking mode, not detection-only.
4. Hunt for prior compromise on any host that ran ≤ 3.5.10 on the internet — Assume breach on any Joomla box that was internet-reachable between the patch release (27 Jun) and your remediation date. Grep webroot for recently-modified .php files under images/, review web-access logs for POSTs to Page Builder CK upload endpoints, audit #__users for unknown Super Users, and rotate credentials in configuration.php.
5. If patching within hours is impossible, take the site offline or firewall it — Better an outage than a webshell. Pull the DNS record or block port 443 at the edge until the update lands.

Run from an auditor workstation with network access to the target Joomla site. Invoke as ./check-cve-2026-56290.sh https://target.example.com. No credentials required — this only fingerprints the extension and its version from public assets.

#!/usr/bin/env bash
# noisgate check for CVE-2026-56290 — Page Builder CK unauth file upload
# Usage: ./check-cve-2026-56290.sh https://target.example.com
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <https://target>" >&2
  exit 2
fi
TARGET="${TARGET%/}"

UA="noisgate-cve-check/1.0"
FIXED_CURRENT="3.6.0"
FIXED_J4="3.4.10"
FIXED_J3="3.1.1"

# 1. Detect Page Builder CK asset paths
HTTP_CODE=$(curl -sk -o /dev/null -w "%{http_code}" -A "$UA" \
  "$TARGET/media/com_pagebuilderck/css/pagebuilderck.css")

if [[ "$HTTP_CODE" != "200" ]]; then
  # Try alternate asset dir
  HTTP_CODE=$(curl -sk -o /dev/null -w "%{http_code}" -A "$UA" \
    "$TARGET/components/com_pagebuilderck/pagebuilderck.xml")
fi

if [[ "$HTTP_CODE" != "200" ]]; then
  echo "UNKNOWN — Page Builder CK not detected on $TARGET (component may be absent, renamed, or WAF-blocked)"
  exit 0
fi

# 2. Attempt to read manifest for version
MANIFEST=$(curl -sk -A "$UA" "$TARGET/administrator/components/com_pagebuilderck/pagebuilderck.xml" 2>/dev/null)
VERSION=$(echo "$MANIFEST" | grep -oE '<version>[^<]+' | head -1 | sed 's/<version>//')

if [[ -z "$VERSION" ]]; then
  # fall back to guessing from CSS asset hash if present
  echo "UNKNOWN — component detected but version not disclosed publicly; manually verify against 3.6.0 / 3.4.10 / 3.1.1"
  exit 0
fi

# 3. Version comparison
ver_lte() { [[ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -1)" == "$1" ]]; }

if ver_lte "$VERSION" "3.1.0"; then
  echo "VULNERABLE — Page Builder CK $VERSION (< $FIXED_J3 for Joomla 3)"
  exit 1
elif [[ "$VERSION" == 3.1.* || "$VERSION" == 3.2.* || "$VERSION" == 3.3.* ]]; then
  # Joomla 3 line — fixed at 3.1.1
  if ver_lte "$VERSION" "3.1.0"; then
    echo "VULNERABLE — Page Builder CK $VERSION"; exit 1
  fi
  echo "PATCHED — Page Builder CK $VERSION"; exit 0
elif [[ "$VERSION" == 3.4.* ]]; then
  if ver_lte "$VERSION" "3.4.9"; then
    echo "VULNERABLE — Page Builder CK $VERSION (needs $FIXED_J4)"; exit 1
  fi
  echo "PATCHED — Page Builder CK $VERSION"; exit 0
elif ver_lte "$VERSION" "3.5.10"; then
  echo "VULNERABLE — Page Builder CK $VERSION (needs $FIXED_CURRENT)"
  exit 1
else
  echo "PATCHED — Page Builder CK $VERSION"
  exit 0
fi

Sources

1. mySites.guru — original disclosure (Phil Taylor)
2. CCB Belgium national advisory
3. SentinelOne vulnerability database
4. Mallory AI vulnerability write-up
5. IONIX threat center
6. Feedly CVE-2026-56290
7. OpenCVE record
8. Joomla Extensions Directory — Page Builder CK