CVE Catalog
CVE-2026-63048
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk0.23%
13th percentile - higher than 13% of all known CVEs
Summary
The Joomla extension Page Builder CK below version 3.6.2 has an improper access control vulnerability, allowing an authenticated attacker to upload arbitrary files, leading to remote code execution (RCE).
Risk Assessment
Risk includes server takeover by an authenticated user through malicious file upload, potentially leading to full system compromise.
Recommendation
Immediately update the Page Builder CK extension to version 3.6.2 or later.
Original NVD description (English source)
Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE.