Security
PageBuilder CK fix left Joomla RCE open to Editors
Joomlack has released PageBuilder CK 3.6.3 after researchers found that versions 3.6.0 through 3.6.2 only partially fixed a critical file-upload vulnerability, leaving Joomla Editor accounts able to execute code.
mySites.guru published the research on the incomplete remediation of CVE-2026-56290, a critical remote code execution flaw originally rated CVSS 10.0. The first fix blocked unauthenticated requests, but did not restore the upload handler’s file-type restriction. As a result, an account with Joomla’s core.edit permission could still upload and run a PHP file through PageBuilder CK.
The issue was confirmed on a clean test installation using a harmless marker file. mySites.guru said it is not publishing a working exploit, and reported no involvement of customer or third-party sites. Joomlack’s 3.6.3 release restores the media-file allow-list and rejects the same upload.
- Update every PageBuilder CK installation from
3.6.0,3.6.1or3.6.2to3.6.3. - Block PHP execution in writable directories such as
/images,/media,/templatesand/tmp. - Review Editor accounts and investigate possible compromise where untrusted accounts had access.
Originally reported by mySites.guru.