External risk intelligence

Joomla Page Builder CK Arbitrary File Upload Leads to RCE

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-63048

The vulnerability affects a Joomla extension, which is a component of a web application. Joomla sites are commonly deployed as public-facing websites. While the vulnerability requires authentication, the nature of a web application extension means it resides on an internet-facing surface, making it reachable in common deployment patterns.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE concerns a critical vulnerability in the Joomla extension Page Builder CK that allows authenticated users to upload arbitrary files, potentially leading to remote code execution. The main concern is confirming relevance and exposure of this extension within your environment.

File upload vulnerability allows unauthorized code execution.
Affects a common web application extension.
Confirm if this extension is used and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to the Joomla Page Builder CK extension can upload a malicious file. This capability allows them to bypass security measures and potentially achieve remote code execution on the server.

Authenticated user access is required.
Uploading a crafted file triggers the vulnerability.
Risk of remote code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

Authenticated users could upload arbitrary files, potentially leading to the execution of malicious code on the server. This could impact the integrity and availability of the Joomla site and its underlying infrastructure when the extension is used.

Server-side code execution.
Authenticated user uploads file.
Compromised website and server.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Joomla extension Page Builder CK impacts web applications, likely managed by application owners and infrastructure or platform teams. The first step is to inventory all Joomla instances, identify those using this extension, assess their exposure and business criticality, and confirm the accountable owner before planning remediation.

Identify accountable application or platform owners.
Verify extension presence and network reachability.
Plan remediation considering business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Page Builder CK extension?

Page Builder CK is an extension for the Joomla content management system, created by JoomlaCK. It provides users with a drag-and-drop interface to design and structure pages on their websites. Because it integrates directly into the Joomla platform, it runs alongside other site components to manage visual layouts and content presentation.

What does arbitrary file upload mean in CVE-2026-63048?

This vulnerability falls under the Unrestricted Upload of File with Dangerous Type weakness class (CWE-434). It means the extension fails to properly validate the files a user submits. An attacker can upload malicious scripts disguised as legitimate files, which the server then stores and potentially executes, leading to full remote code execution.

How is this vulnerability triggered?

An attacker must first have authenticated access to the Joomla environment where Page Builder CK is installed. Once logged in, they can interact with the extension's file handling functions to upload a crafted file. The vulnerability is not triggered by simple site browsing; it specifically requires the ability to perform an upload action within the extension.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal flags this as a priority because Page Builder CK is a component of web applications, which are typically internet-facing. Even though authentication is required, the public nature of most Joomla installations means that if an account is compromised or unauthorized access is gained, the extension becomes a reachable target for server-side exploitation.

What should I do if I use Page Builder CK?

Begin by auditing your Joomla instances to confirm if this specific extension is installed. Identify the team responsible for each site, assess how accessible those sites are to the public, and determine their business criticality. Once you have an accurate inventory of where the extension exists, coordinate with the site owners to prepare for necessary security updates or configuration changes.

References

www.joomlack.fr/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.