CVE-2026-56290 is a critical-severity vulnerability, listed in the CISA KEV catalog. AttackerView checks Page Builder CK sites for it with a live exploit check.
Detects Page Builder CK for Joomla installations vulnerable to unauthenticated arbitrary file write leading to remote code execution. In every version before 3.6.0 the component runs each front-end task with no authorization check at all, so the fonts.save task is reachable by any anonymous visitor who first reads the Joomla form token out of the site's own markup. That task fetches a URL taken straight from the request, scans the response for font references, and writes every referenced file into media/com_pagebuilderck/gfonts/ under the name the response supplies, with no extension filter. A stylesheet pointing at a PHP file therefore drops executable code into the web root, which is exactly where shells were found on compromised sites. The verifier reaches the task without credentials, proves the server performed the fetch it asked for by reading the per-run hostname back out of the server's own transfer error, and confirms an analyzer-named file appeared under the document root. CVSS 9.8, CISA KEV. Upgrade Page Builder CK to 3.6.0 or later.
Is your app exploitable through CVE-2026-56290?
Scan your domain free