CVE-2026-56290 — Joomla "Page Builder CK" Unauthenticated Upload → Webshell RCE

CVE-2026-56290 (CVSS 10.0) is an improper access control / unauthenticated arbitrary file upload vulnerability in Joomlack "Page Builder CK" (com_pagebuilderck), a popular Joomla page-builder extension. A front-end upload endpoint accepts files with no authentication and no permission check, and lets the caller choose the destination folder. An unauthenticated attacker uploads a PHP file into a web-served directory and requests it — direct remote code execution.

The flaw affects every version up to and including 3.5.10. It was fixed in 3.6.0 (released 2026-06-27), with back-ports to 3.1.1 (Joomla 3) and 3.4.10 (Joomla 4). Exploitation has been observed in the wild since 2026-06-27 to plant webshells, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-07 with a federal remediation deadline of 2026-07-10. The first confirmed webshell was dropped at /media/com_pagebuilderck/gfonts/bhup.php — an uploader shell keyed on the $_POST['_upl'] field.

Because the upload is unauthenticated, this is mass-scannable and mass-exploitable: any internet-facing Joomla site running a vulnerable Page Builder CK is a target. The detectable endpoint story is post-exploitation on the web server itself — a new PHP file appearing in an asset/upload directory, and the web server or a PHP worker spawning a shell.

Defender priority: (1) Patch Page Builder CK to 3.6.0 / 3.4.10 / 3.1.1 now. (2) Hunt the web hosts for a PHP file written under /media/com_pagebuilderck/ (esp. the gfonts/ folder) and for the named shell bhup.php. (3) Hunt for the web server / php-fpm process spawning a shell (Q1) — the highest-fidelity RCE signal. Treat any hit as a confirmed compromise: preserve the shell, then eradicate and rebuild.

Hunter note: Do not confuse this with the sibling KEV entry CVE-2026-48908 (JoomShaper SP Page Builder, also CVSS 10.0 file-upload) — different vendor/extension, similar tradecraft. This pack targets Joomlack Page Builder CK (com_pagebuilderck). The single published atomic IOC is the bhup.php shell name + path; attackers will vary the filename, so the durable hunt is any new PHP under Joomla asset/upload dirs (Q2/Q4) plus web-server shell spawns (Q1). No file hashes were published at pack time — the IOC CSV uses REPLACE_WITH placeholders rather than fabricated hashes.

Hunt Hypotheses (fidelity-ordered)

1. H1 (high): A web-server / PHP worker (php-fpm, httpd, apache2, nginx, lsphp) spawns a shell/LOLBin (sh, bash, curl, python) — webshell command execution. low FP
2. H2 (high): A new .php file is written under /media/com_pagebuilderck/ (esp. gfonts/) — the webshell drop. low FP
3. H3 (high): The named shell bhup.php appears on disk or in a PHP command line. low FP
4. H4 (medium): Any new .php file written into a Joomla static-asset/upload dir (/media/, /images/, /tmp/) that should hold no code. med FP
5. H5 (medium): A PHP command line containing webshell primitives (shell_exec, system(, base64_decode, eval(, _upl). med FP
6. H6 (medium): A web-server-context process makes an outbound connection to a non-RFC1918 raw IP — reverse shell / second-stage pull. med FP
7. H7 (medium): A LOLBin (curl/wget) downloads a file into a web-served path — tooling staged into web root. med FP

Attack Chain

Web-root sweep for dropped PHP shells (run on every Joomla host)

# PHP anywhere it should not be (media/images/tmp are asset dirs, not code)
find /var/www /home/*/public_html -type f -name "*.php" \
  \( -path "*/media/*" -o -path "*/images/*" -o -path "*/tmp/*" \) 2>/dev/null
# The named shell + component drop dir specifically
find / -type f -name "bhup.php" 2>/dev/null
ls -la /var/www/*/media/com_pagebuilderck/gfonts/ 2>/dev/null
# PHP files newer than the patch window (likely attacker-dropped)
find /var/www -type f -name "*.php" -newermt "2026-06-27" 2>/dev/null

Webshell content grep (uploader/eval primitives)

grep -rEln "_upl|shell_exec|passthru|system\(|eval\(|base64_decode|move_uploaded_file" \
  /var/www/*/media /var/www/*/images 2>/dev/null

Version check + web-log triage

# Confirm installed Page Builder CK version (look for <= 3.5.10)
grep -R "version" /var/www/*/administrator/components/com_pagebuilderck/*.xml 2>/dev/null
# In your proxy/WAF logs: POST requests to com_pagebuilderck upload endpoints,
# especially those immediately followed by a GET to a new /media/*.php path.

Note: The shell is unauthenticated to plant — absence of auth logs does NOT mean no compromise. A vulnerable version + any new PHP in an asset dir = treat as compromised until proven otherwise. Patch AND remove the shell; patching alone leaves the backdoor in place.

Promotion path: Q1, Q2, Q3 are strong IOA/Prevent candidates (attacker-specific, low FP). Q4–Q7 stay Investigate-only until per-site baselined, and are strongest correlated on the same aid.

1 · Deny PHP execution in Joomla asset dirs (Apache)

# Drop into /var/www/<site>/media/.htaccess (and images/, tmp/)
<FilesMatch "\.(php|phtml|php3|php4|php5|phar)$">
  Require all denied
</FilesMatch>
php_admin_flag engine off

2 · Deny PHP execution in asset dirs (nginx)

location ~* ^/(media|images|tmp)/.*\.php$ {
    deny all;
    return 403;
}

3 · Find & quarantine dropped shells (bash)

#!/usr/bin/env bash
set -euo pipefail
WEBROOT="${1:-/var/www}"
Q="/root/quarantine_$(hostname)"
mkdir -p "$Q"
find "$WEBROOT" -type f -name "*.php" \
  \( -path "*/media/*" -o -path "*/images/*" -o -path "*/tmp/*" \) \
  -newermt "2026-06-27" -print 2>/dev/null | while read -r f; do
    echo "[!] quarantining $f"
    mv "$f" "$Q/"
done
find "$WEBROOT" -type f -name "bhup.php" -exec mv {} "$Q/" \; 2>/dev/null || true

4 · Confirm patched version

grep -R "version" /var/www/*/administrator/components/com_pagebuilderck/*.xml 2>/dev/null
# Ensure the reported version is 3.6.0 / 3.4.10 / 3.1.1 or later

Endpoint coverage of the post-exploitation chain (drop → execute → egress) is strong (Q1/Q2/Q3). The initial unauthenticated upload itself is a web-log / WAF hunt (§7) — Falcon endpoint telemetry does not see the HTTP request, so pair this pack with proxy/WAF log detection. File-write queries (Q2/Q4) depend on non-PE file-write telemetry — validate it flows in your tenant (§11).