August 3, 2026 · Alastor InfoSec Team
CVE-2026-56290: Joomlack Page Builder CK CVSS 10.0 Unauthenticated RCE — CISA KEV, Patch Immediately
A critical unauthenticated remote code execution vulnerability in a widely used Joomla page builder extension has been added to CISA's Known Exploited Vulnerabilities catalog, and active exploitation has been confirmed in the wild. CVE-2026-56290 affects the Page Builder CK extension for Joomla, developed by Joomlack, and carries a maximum CVSS score of 10.0. Any Joomla site running a vulnerable version is exposed to full server compromise via a single HTTP request requiring no authentication, no credentials, and no prior access.
Vulnerability Details
CVE: CVE-2026-56290
CVSS Score: 10.0 (Critical)
Affected Product: Page Builder CK extension for Joomla (joomlack.fr)
Affected Versions: All versions prior to 3.6.0
Vulnerability Type: Improper Access Control / Unrestricted File Upload leading to Remote Code Execution
CISA KEV Added: July 7, 2026
Patch Available: Yes — upgrade to version 3.6.0 or later
The vulnerability lives in the extension's front-end file upload handler. The handler performed no authentication or authorisation checks — any visitor to the site could reach the upload endpoint and submit a payload. The only control in place was a CSRF token, but that token could be retrieved from the site's own public pages in a single GET request before submitting the malicious upload. This makes the attack entirely self-contained and automatable.
The exploitation sequence is straightforward: an attacker sends a POST request to the vulnerable endpoint with a web shell or other executable payload embedded in a file with an executable extension. They then send a GET request to the location where the extension stores uploaded files to trigger execution. Depending on server configuration, this gives the attacker arbitrary command execution in the context of the web server process — typically with enough privilege to read the Joomla database configuration, extract credentials, and pivot further.
Why This Is Reaching Maximum CVSS
CVSS 10.0 requires all three attack vector dimensions to be at their worst: network-accessible without authentication, no complexity or interaction required, and complete compromise of confidentiality, integrity, and availability. CVE-2026-56290 satisfies all three. The attacker does not need to be on the same network, does not need to perform any prerequisite steps, and does not need to trick a user into doing anything. One POST request, one GET request, and the server is compromised.
The Belgian Centre for Cybersecurity (CCB) issued a public advisory classifying this as a critical priority, noting that "any Joomla site running a vulnerable version of Page Builder CK is exposed to complete compromise." CISA's addition to the KEV catalog on July 7 confirmed that this is not theoretical — attackers are actively scanning for and exploiting vulnerable installations.
What Attackers Are Doing With It
Based on observed exploitation patterns from similar Joomla file upload vulnerabilities, the likely post-exploitation sequence involves deploying a persistent web shell to maintain access, enumerating the server filesystem and database for credentials, exfiltrating the Joomla configuration.php file (which contains plaintext database credentials), and using those credentials to pivot into the database to extract user tables, including administrative credentials and any stored personal data.
For organisations using Joomla to manage customer data — common in Indian e-commerce, publishing, and government portal deployments — this means a CVE-2026-56290 exploit is not just a website defacement risk. It is a data breach risk with direct DPDPA and CERT-In implications. Under DPDPA, a breach of personal data triggers a 72-hour notification obligation to the DPBI. Under CERT-In, the same breach triggers a 6-hour mandatory report. An unpatched Joomla installation holding customer records is a regulatory exposure, not just a security one.
Affected Versions and Remediation
Every installation of the joomlack.fr Page Builder CK extension running any version prior to 3.6.0 is vulnerable. The fix is available: upgrade to version 3.6.0 immediately.
If you cannot upgrade immediately — for example, if the upgrade requires testing against a complex Joomla installation or custom templates — there are interim mitigations to apply while you prepare the upgrade. Disable the Page Builder CK extension entirely in the Joomla Extension Manager until the upgrade can be applied. Additionally, restrict web server write permissions on the uploads directory where the extension stores files, and add a server-side rule (via .htaccess or NGINX configuration) blocking execution of uploaded files from the extension's upload path. These mitigations reduce but do not eliminate risk; the patch is the only definitive fix.
After patching, review your access logs for POST requests to the Page Builder CK upload endpoint from unexpected IP addresses, particularly in the period between initial public disclosure and your patch deployment. If you find evidence of exploitation, treat it as a confirmed breach and initiate your incident response process.
The Broader Joomla Extension Risk Pattern
CVE-2026-56290 is the third Joomla extension to reach CISA KEV status since June 2026, following CVE-2026-48908 (JoomShaper SP Page Builder) and CVE-2026-56291 (Balbooa Forms) — all involving unauthenticated file upload leading to RCE. This is not coincidence. It reflects a structural weakness in how many Joomla extensions handle file uploads: validation is implemented per-extension rather than enforced at the framework level, leading to inconsistent and often absent security controls.
For security teams managing Joomla deployments, this pattern has an actionable implication: your vulnerability management programme needs to cover third-party extensions, not just Joomla core. Most Joomla vulnerabilities that result in active exploitation come from extensions, not from the CMS itself. An inventory of installed extensions and their versions, checked against the CISA KEV catalog and the Joomla Vulnerable Extensions List (VEL), should be a weekly process, not an annual one.
Alastor Pulse's continuous vulnerability scanning covers web application components including CMS plugins and extensions, surfacing new CVEs against your installed inventory before attackers can exploit them. For teams managing multiple Joomla installations, the time-to-alert on new critical CVEs is under 6 hours from public disclosure.
Detection Guidance
To check your exposure, inspect your Joomla installation for the Page Builder CK extension and verify its version number. In the Joomla Administrator panel, navigate to Extensions → Manage → Installed and search for "Page Builder CK." If the version shows as anything earlier than 3.6.0, you are vulnerable.
At the network level, configure your web application firewall to alert on POST requests to paths associated with the extension's upload handler. The specific path varies based on installation, but common patterns include /components/com_sppagebuilder/assets/ variants. If your WAF logs show unusual POST traffic to these paths from external IPs, examine the requests closely.
After you patch, verify the fix by checking that the upload endpoint now returns a 403 or authentication challenge for unauthenticated requests. Do not assume the upgrade applied correctly — verify it.
Summary
CVE-2026-56290 is a maximum-severity, zero-interaction unauthenticated RCE in a widely deployed Joomla extension. Active exploitation is confirmed. If you run Joomla with Page Builder CK installed, your remediation priority is to upgrade to 3.6.0 immediately, or disable the extension until you can. Then review your logs for evidence of exploitation since July 7.
For organisations holding personal data under DPDPA, the risk is not limited to server compromise — it is a confirmed path to regulatory penalties and breach notification obligations. Patch now.
To assess your web application security posture or investigate potential exploitation, contact Alastor InfoSec at [email protected] or learn more about our continuous vulnerability management at /products/alastor-pulse.