CVE-2026-56290: Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0

Synopsis

An unauthenticated arbitrary file upload vulnerability exists in the Page Builder CK extension for Joomla, versions 1.0 through below 3.6.0, developed by JoomlaCK.fr. The flaw is reachable over the network with no credentials required and no victim interaction needed, making it trivially exploitable from the open internet. Successful exploitation gives an attacker full remote code execution on the host running the Joomla installation. No fix version has been published; HarborGuard is tracking the advisory and will make a patched rebuild available the moment upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The extension exposes its file upload functionality over the network, so an attacker must be able to reach the Joomla web service to exploit this vulnerability.

• AuthenticationNot required

  No account or session credentials of any privilege level are needed; the upload endpoint accepts requests from unauthenticated users.

• Victim interactionNot required

  Exploitation is fully server-side and requires no action from any user or administrator of the Joomla site.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental prerequisites.

Blast Radius

• An attacker uploads and executes arbitrary server-side code, achieving full remote code execution on the Joomla host.
• All data accessible to the web server process, including database credentials, user records, and stored session tokens, can be read directly.
• An attacker can write, modify, or delete files and database content across the Joomla installation, including content served to end users.
• The compromise extends to systems reachable from the host, since CVSS v4 sub-system scores are all High, meaning downstream services and infrastructure connected to the Joomla environment are also at risk.