{"id":"CVE-2026-56290","kind":"vulnerability","aliases":["CVE-2026-56290"],"related":[],"title":"joomlack page builder ck: Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla…","description":"Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Joomlack Page Builder, a Joomla extension, has an improper access control flaw that lets an unauthenticated visitor upload arbitrary files. Uploading a crafted file can lead to remote code execution on the web server, and CISA lists it as actively exploited.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-07-07T00:00:00+00:00","products":[{"name":"Joomlack Page Builder","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"joomlack page builder ck","fixed":["3.6.0"],"affected":"< 3.6.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","joomla","joomlack-page-builder","package","self-hosted"],"not_affected_if":["joomla-without-joomlack"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-06-29T15:16:42+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:45+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:33:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","summary":"Joomlack Page Builder, a Joomla extension, has an improper access control flaw that lets an unauthenticated visitor upload arbitrary files. Uploading a crafted file can lead to remote code execution on the web server, and CISA lists it as actively exploited.","category":"package","who_cares":["joomla","joomlack-page-builder","self-hosted"],"confidence":0.6,"analyst_note":"Find the affected and fixed Joomlack versions and the vendor advisory; check the CISA KEV entry and BOD 26-04 notes for patch guidance and IOCs.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["joomla-without-joomlack"],"severity_if_unknown":"critical"},"cost_usd":0.000353,"input_tokens":2192,"output_tokens":267,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':121C,147C,178C '-2026':20A,23A '-56290':21A,24A '26':120C,146C,177C '3.6.0':16A 'access':51B,89C 'accord':110C 'action':106C 'activ':81B 'adher':174C 'allow':94C 'appli':107C 'applic':144C 'arbitrari':60B,101C 'asset':168C 'base':125C 'bod':119C,145C,176C 'builder':3A,13A,27A,30A,37B,44B,85C 'cisa':77B,104C,117C,134C 'ck':4A,14A,31A 'cloud':150C 'code':70B,97C 'complianc':115C 'contain':86C 'control':52B,90C 'could':93C 'craft':64B 'cve':19A,22A 'discontinu':153C 'ensur':114C,173C 'evalu':166C 'execut':71B,98C 'exploit':32B,82B 'exposur':171C 'extens':6A,15A,47B 'file':9A,61B,65B,102C 'flaw':53B 'follow':143C 'forens':136C 'guidanc':132C,148C 'guidelin':180C 'host':41B 'improp':50B,88C 'instruct':113C 'internet':170C 'joomla':5A,18A,33B,46B 'joomlack':1A,25A,28A,35B,42B,83C 'joomlack-page-build':34B 'joomlack.fr':7A 'lead':67B 'let':55B 'list':78B 'mitig':108C,159C 'note':131C,142C 'packag':38B 'page':2A,12A,26A,29A,36B,43B,84C 'patch':179C 'priorit':122C 'product':157C 'remot':69B,96C 'requir':105C,138C 'respons':164C 'risk':127C 'secur':123C 'see':128C,139C 'self':40B 'self-host':39B 'server':75B 'servic':151C 'stakehold':162C 'triag':137C 'unauthent':8A,57B,100C 'unavail':161C 'updat':124C 'upload':10A,59B,62B,103C 'url':129C,140C 'use':154C 'vendor':112C 'via':99C 'visitor':58B 'vulner':91C 'web':74B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-29T15:16:42+00:00","kev":{"dateAdded":"2026-07-07","dueDate":"2026-07-10","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-56290","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-56290","severity":null,"published_at":"2026-07-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-56290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56290","severity":null,"published_at":"2026-06-29T15:16:42+00:00","modified_at":"2026-10-07T19:17:38+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}