CVE-2026-56290

This flaw lets an attacker upload a file to your Joomla website without needing an account. Worse, the uploaded file can be run, meaning attackers can effectively take control of your site. Think of it like leaving a “drop a file here” door unlocked, where the file can include instructions to break into the rest of your building.

This matters if you run a Joomla website that has the Page Builder CK extension for Joomla (page builder ck) installed and its version is less than 3.6.0. Because the upload can be done without authentication and without user interaction, it’s a direct internet-facing risk when the vulnerable site is reachable. The practical risk is highest when your site is publicly accessible and the vulnerable extension is installed and enabled.

This is RED because CISA added CVE-2026-56290 to its Known Exploited Vulnerabilities and specifically cites active exploitation. Attackers are using the unauthenticated file upload to execute code and take over affected Joomla sites, so waiting increases the chance your site is already compromised.