{"id":"CVE-2026-56290","title":"Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and…","summary":"Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-434"],"vendor":"joomlack","product":"page_builder_ck","affected":["page_builder_ck < 3.6.0"],"patched":["page_builder_ck 3.6.0"],"published":"2026-06-29","updated":"2026-10-07","sourceUpdated":"2026-10-07T19:17:38.810","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56290","references":[{"url":"https://www.joomlack.fr/","label":"security@joomla.org"},{"url":"https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","exploit-available","cve.org"],"epss":0.30866,"epssPercentile":0.98242,"kev":true,"kevDateAdded":"2026-07-07","kevDueDate":"2026-07-10","kevRansomware":false,"exploited":true,"exploits":{"exploitdb":true,"github":5,"githubRepos":["https://github.com/Jenderal92/CVE-2026-56290","https://github.com/shinthink/pbck-exploit","https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit"],"nuclei":["CVE-2026-56290"],"checkedAt":"2026-10-27T19:04:38.615Z"},"exploitAvailable":true,"ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total","timestamp":"2026-07-08T03:56:32.575114Z"},"scores":{"nvd":9.8,"cna":10},"ingestedAt":"2026-07-03T13:02:28.091Z","slug":"CVE-2026-56290","body":"## Overview\n\nJoomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.\n\n## Affected\n\n- `page_builder_ck < 3.6.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `page_builder_ck 3.6.0`","depth":"hadal","depthScore":85,"depthScoreParts":{"impact":53.9,"likelihood":6.2,"exploitation":25,"ransomware":0},"changes":[{"seq":179,"id":"CVE-2026-56290","ts":1787603664836,"field":"epss","old":"0.83254","new":"0.30375"},{"seq":94,"id":"CVE-2026-56290","ts":1784920495240,"field":"epss","old":"0.18707","new":"0.83254"},{"seq":76,"id":"CVE-2026-56290","ts":1784747473285,"field":"epss","old":"0.02912","new":"0.18707"},{"seq":61,"id":"CVE-2026-56290","ts":1783623149912,"field":"exploit_available","old":"false","new":"true"},{"seq":59,"id":"CVE-2026-56290","ts":1783533111728,"field":"exploited","old":"false","new":"true"},{"seq":58,"id":"CVE-2026-56290","ts":1783533111728,"field":"kev","old":"false","new":"true"},{"seq":55,"id":"CVE-2026-56290","ts":1783532625218,"field":"exploited","old":"true","new":"false"},{"seq":54,"id":"CVE-2026-56290","ts":1783532625218,"field":"kev","old":"true","new":"false"},{"seq":51,"id":"CVE-2026-56290","ts":1783529208200,"field":"exploited","old":"false","new":"true"},{"seq":50,"id":"CVE-2026-56290","ts":1783529208200,"field":"kev","old":"false","new":"true"}]}