CVE-2026-63048 CRITICAL

CVE-2026-63048: Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2

Vendor Joomlack.fr
Product Page Builder CK extension for Joomla
Weakness CWE-434 · Unrestricted file upload
Published July 22, 2026
Last update July 23, 2026
View on NVD All CVEs

CVSS base score

9.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE.

Explanation of Vulnerability in Simple Terms

02Summary

Page Builder CK extension for Joomla contains an unrestricted file upload vulnerability. An authenticated user with low privileges can upload arbitrary files to the server, potentially including executable code. This allows attackers to run their own PHP code on the site and take full control. The vulnerability affects versions 1.0.0 through 3.6.2.

What an attacker can do

03Attacker Capabilities

Upload arbitrary files, including executable code, to run PHP on the site.

Potential impact on your site

04Site Impact

Compromised Joomla site; attacker gains ability to modify content, steal data, or inject malware.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege Joomla user account (e.g., contributor or editor role).

Key dates

06Disclosure timeline

July 22, 2026 CVE published
July 23, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-5364 Drag and Drop File Upload for Contact Form 7 <= 1.1.3 - Unauthenticated Arbitrary File Upload via sanitize_file_name Bypass CVE-2025-13067 Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass CVE-2024-58348 WordPress Background Image Cropper 1.2 Remote Code Execution CVE-2026-39591 WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability CVE-2026-21628 Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla