Joomlack Page Builder CK upload flaw CVE-2026-56290 exploited to compromise Joomla websites
Attackers used a Page Builder CK flaw to upload and run code on Joomla websites without logging in. Fixes are available. Ask your website manager to install the latest compatible release and check the whole site for backdoors.
If you own a Joomla website, ask its manager to install the latest compatible Page Builder CK release; on Joomla 5 or 6, use at least 3.6.5. Older Joomla installations need their specific vendor security builds and a migration plan to a supported Joomla version. Have the whole website checked for backdoors, and change website credentials after cleaning any compromise.
What’s happening
CVE-2026-56290 affects Page Builder CK, Joomlack’s website-building extension for Joomla. Missing access checks allowed someone without an account to upload executable files and run code on the website’s server. Joomlack released 3.6.0 on 27 June, and mySites.guru reported a real website compromise that day. CISA listed the flaw as exploited on 7 July; ransomware involvement remains unknown. Joomlack also announced security updates for its older Joomla 3 and 4 branches. The original anonymous attack route is fixed. Researchers subsequently found that an editor account could still misuse uploads in the current branch until 3.6.3; this required a login and was a separate follow-up flaw. Further security corrections led researchers to recommend 3.6.5 or later. Updating does not remove backdoors already planted, so affected websites also need a compromise check. The reviewed sources do not establish a total number of victims.
- What
- Flaw
- Affects
- Joomlack Page Builder CK extension for Joomla
- Affected
- Page Builder CK current branch before 3.6.0
Older Page Builder CK branches for Joomla 3 and Joomla 4 before their vendor security updates - Fixed in
- Page Builder CK 3.6.0 closes the unauthenticated attack route in the current branch
Joomla 3 and Joomla 4 security builds linked in Joomlack’s security alert; that statement does not specify their version numbers - Since
- 7 July 2026
- Closed
- 17 Aug 2026
Timeline
- Vendor revised
Joomlack released 3.6.5 with another security correction in styles loading. mySites.guru updated its remediation advice to recommend 3.6.5 rather than stopping at the original 3.6.0 fix.
- New fix
Joomlack released 3.6.3 with further upload security changes. mySites.guru says this also closed a remaining upload weakness requiring an editor account; the original anonymous attack route had already been blocked by 3.6.0.
- CISA added
CISA added CVE-2026-56290 to its Known Exploited Vulnerabilities catalogue. Its entry lists ransomware involvement as unknown.
- Made public
Joomla published CVE-2026-56290 for the unauthenticated file-upload vulnerability, crediting Phil Taylor of mySites.guru.
- Wider attacks
mySites.guru reported finding an attacker’s backdoor on a customer’s Joomla website within hours of the fix, attributing the compromise to this upload flaw.
- New fixFixed
Joomlack released Page Builder CK 3.6.0 and urged users to update immediately to address a security vulnerability.
Sources
- Page Builder CK — release notesJoomlack
- Page Builder CK VulnerabilityJoomlack
- PageBuilder CK File Upload RCE — June 2026mySites.guru · 27 June 2026
- PageBuilder CK RCE fixed — again — correctly this timemySites.guru
- CVE-2026-56290 — Joomla CNA recordJoomla CNA, reproduced by OpenCVE · 12 Aug 2026
- CISA Known Exploited Vulnerability entry: CVE-2026-56290CIRCL, reproducing CISA’s entry · 7 July 2026
- Security issue J4Joomlack