Live This site runs Joomla 6.1.2
JoomClub

News, security and craft for the Joomla ecosystem

Security

PageBuilder CK fix left Joomla RCE open to Editors

Joomlack has released PageBuilder CK 3.6.3 after researchers found that versions 3.6.0 through 3.6.2 only partially fixed a critical file-upload vulnerability, leaving Joomla Editor accounts able to execute code.

mySites.guru published the research on the incomplete remediation of CVE-2026-56290, a critical remote code execution flaw originally rated CVSS 10.0. The first fix blocked unauthenticated requests, but did not restore the upload handler’s file-type restriction. As a result, an account with Joomla’s core.edit permission could still upload and run a PHP file through PageBuilder CK.

The issue was confirmed on a clean test installation using a harmless marker file. mySites.guru said it is not publishing a working exploit, and reported no involvement of customer or third-party sites. Joomlack’s 3.6.3 release restores the media-file allow-list and rejects the same upload.

  • Update every PageBuilder CK installation from 3.6.0, 3.6.1 or 3.6.2 to 3.6.3.
  • Block PHP execution in writable directories such as /images, /media, /templates and /tmp.
  • Review Editor accounts and investigate possible compromise where untrusted accounts had access.

Originally reported by mySites.guru.