CVE-2026-39292: Falco Solutions PHPPageBuilder v0

Synopsis

An unrestricted file upload vulnerability in Falco Solutions PHPPageBuilder v0.31.0 allows remote attackers to upload arbitrary files, including server-side scripts, through the pagemanager/pagebuilder module. The service is reachable over the network and requires no authentication, meaning any attacker who can reach the endpoint can attempt exploitation. Successful exploitation gives the attacker remote code execution on the host. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the service via HTTP/HTTPS.

• AuthenticationNot required

  No credentials are needed; the upload endpoint accepts requests from unauthenticated remote users.

• Victim interactionNot required

  The attacker interacts directly with the server-side endpoint; no user action or social engineering is required.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race wins, or environmental tuning.

Blast Radius

• Attacker uploads and executes arbitrary server-side code, achieving full remote code execution on the host running PHPPageBuilder.
• Confidential files and data accessible to the web server process can be read and exfiltrated.
• Attacker can modify or delete files and application data reachable by the server process.
• The running service or host can be crashed or destabilized, causing a denial of service for legitimate users.