Page Builder CK for Joomla: unauthenticated file upload (CVE-2026-56290)
The Page Builder CK extension (joomlack.fr) for Joomla has a vulnerability, CVE-2026-56290, rated CVSS 10. It allows an unauthenticated attacker to upload an executable file and achieve full remote code execution (RCE). It is listed in CISA KEV, meaning it is exploited in real attacks.
Checked in Shield: no
Who is affected
Joomla sites with the Page Builder CK extension installed in a version below 3.6.0.
How to check
In the Joomla admin, open Extensions → Manage and find Page Builder CK, then check its version. Below 3.6.0 means the site is vulnerable. Also look for unfamiliar executable files (such as PHP) in upload directories.
How to fix
A fix is available: update Page Builder CK to version 3.6.0 or later. After updating, scan the site for web shells and unexpected files.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Attack details and the scale of exploitation are not disclosed yet; source: the NVD entry for CVE-2026-56290.
