CVE-2026-56290
CRITICALDescription
The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| joomlack | page_builder_ck |
References
Advisories & Patches
Other References
Frequently Asked Questions
What is CVE-2026-56290? +
How severe is CVE-2026-56290? +
What products are affected by CVE-2026-56290? +
How do I check if I'm vulnerable to CVE-2026-56290? +
Related Vulnerabilities
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a …
The <redacted>.exe or <redacted>.exe CGI binary can be used to upload arbitrary files to /tmp/upload/ or /tmp/ respectively as any …
Emlog is an open source website building system. Prior to version 2.6.11, insecure plugin upload functionality allows attackers to upload …
Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading …
The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type validation in the /safe/contract/uploadcustomdocuments endpoint. The application validates uploaded …
Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in the /seeyon/htmlofficeservlet endpoint that allows remote attackers to write …