{"id":"joomlack-page-builder-upload-attacks-jun-2026","category":"patch","status":"closed","title":"Joomlack Page Builder CK upload flaw CVE-2026-56290 exploited to compromise Joomla websites","tldr":"Attackers used a Page Builder CK flaw to upload and run code on Joomla websites without logging in. Fixes are available. Ask your website manager to install the latest compatible release and check the whole site for backdoors.","summary":"CVE-2026-56290 affects Page Builder CK, Joomlack’s website-building extension for Joomla. Missing access checks allowed someone without an account to upload executable files and run code on the website’s server. Joomlack released 3.6.0 on 27 June, and mySites.guru reported a real website compromise that day. CISA listed the flaw as exploited on 7 July; ransomware involvement remains unknown. Joomlack also announced security updates for its older Joomla 3 and 4 branches. The original anonymous attack route is fixed. Researchers subsequently found that an editor account could still misuse uploads in the current branch until 3.6.3; this required a login and was a separate follow-up flaw. Further security corrections led researchers to recommend 3.6.5 or later. Updating does not remove backdoors already planted, so affected websites also need a compromise check. The reviewed sources do not establish a total number of victims.","action":"If you own a Joomla website, ask its manager to install the latest compatible Page Builder CK release; on Joomla 5 or 6, use at least 3.6.5. Older Joomla installations need their specific vendor security builds and a migration plan to a supported Joomla version. Have the whole website checked for backdoors, and change website credentials after cleaning any compromise.","product":"Joomlack Page Builder CK extension for Joomla","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-56290"],"tags":["joomlack","joomla","page-builder-ck","file-upload","remote-code-execution","actively-exploited"],"affected":["Page Builder CK current branch before 3.6.0","Older Page Builder CK branches for Joomla 3 and Joomla 4 before their vendor security updates"],"fixed":["Page Builder CK 3.6.0 closes the unauthenticated attack route in the current branch","Joomla 3 and Joomla 4 security builds linked in Joomlack’s security alert; that statement does not specify their version numbers"],"matches":[],"sources":[{"kind":"advisory","title":"Page Builder CK — release notes","url":"https://www.joomlack.fr/en/joomla-extensions/page-builder-ck","by":"Joomlack","date":""},{"kind":"advisory","title":"Page Builder CK Vulnerability","url":"https://forum.joomlack.fr/index.php/divers-miscellaneous/21638-page-builder-ck-vulnerability","by":"Joomlack","date":""},{"kind":"research","title":"PageBuilder CK File Upload RCE — June 2026","url":"https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/","by":"mySites.guru","date":"2026-06-27"},{"kind":"research","title":"PageBuilder CK RCE fixed — again — correctly this time","url":"https://mysites.guru/blog/pagebuilderck-file-upload-rce-incomplete-fix/","by":"mySites.guru","date":""},{"kind":"advisory","title":"CVE-2026-56290 — Joomla CNA record","url":"https://opencve.alliance.unm.edu/cve/CVE-2026-56290","by":"Joomla CNA, reproduced by OpenCVE","date":"2026-08-12"},{"kind":"advisory","title":"CISA Known Exploited Vulnerability entry: CVE-2026-56290","url":"https://cve.circl.lu/known-exploited-vulnerabilities-catalog/506817d1-03c3-41da-b990-e33f2ad9e33d","by":"CIRCL, reproducing CISA’s entry","date":"2026-07-07"},{"kind":"post","title":"Security issue J4","url":"https://forum.joomlack.fr/index.php/page-builder-ck/21801-security-issue-j4?start=6","by":"Joomlack","date":""}],"started":"2026-07-07","closed":"2026-08-17","created":"2026-11-03T22:19:19.071Z","updated":"2026-11-03T22:19:19.071Z","cve_notes":[{"cve":"CVE-2026-56290","name":"Unauthenticated file upload in Page Builder CK","what":"Missing access checks in Page Builder CK’s upload handling let an attacker without a login upload executable files and run code on a Joomla website’s server.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-08-17","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Joomlack released 3.6.5 with another security correction in styles loading. mySites.guru updated its remediation advice to recommend 3.6.5 rather than stopping at the original 3.6.0 fix.","url":"https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/","by":"mySites.guru","patch":null},{"at":"2026-07-21","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Joomlack released 3.6.3 with further upload security changes. mySites.guru says this also closed a remaining upload weakness requiring an editor account; the original anonymous attack route had already been blocked by 3.6.0.","url":"https://mysites.guru/blog/pagebuilderck-file-upload-rce-incomplete-fix/","by":"mySites.guru","patch":null},{"at":"2026-07-07","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-56290 to its Known Exploited Vulnerabilities catalogue. Its entry lists ransomware involvement as unknown.","url":"https://cve.circl.lu/known-exploited-vulnerabilities-catalog/506817d1-03c3-41da-b990-e33f2ad9e33d","by":"CIRCL, reproducing CISA’s entry","patch":null},{"at":"2026-06-29","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Joomla published CVE-2026-56290 for the unauthenticated file-upload vulnerability, crediting Phil Taylor of mySites.guru.","url":"https://opencve.alliance.unm.edu/cve/CVE-2026-56290","by":"Joomla CNA, reproduced by OpenCVE","patch":null},{"at":"2026-06-27","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"mySites.guru reported finding an attacker’s backdoor on a customer’s Joomla website within hours of the fix, attributing the compromise to this upload flaw.","url":"https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/","by":"mySites.guru","patch":null},{"at":"2026-06-27","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Joomlack released Page Builder CK 3.6.0 and urged users to update immediately to address a security vulnerability.","url":"https://www.joomlack.fr/en/joomla-extensions/page-builder-ck","by":"Joomlack","patch":"patched"}],"url":"https://hard.fyi/live/joomlack-page-builder-upload-attacks-jun-2026/","json":"https://hard.fyi/api/live?id=joomlack-page-builder-upload-attacks-jun-2026"}