CVE-2026-39292 describes an unrestricted file upload vulnerability in Falco Solutions PHPPageBuilder v0.31.0 within the pagemanager/pagebuilder module. Due to inadequate validation of uploaded files, attackers can upload arbitrary files, including potentially executable content, which can lead to remote code execution on the affected system. The vulnerability is identified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The CVSS 3.1 base score is 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting a high-severity remote network attack vector with low attack complexity and no privileges or user interaction required. No patch or official remediation has been published as of the provided data.

Successful exploitation allows remote attackers to upload arbitrary files, including executable code, resulting in remote code execution. This can lead to partial confidentiality, integrity, and availability impacts on the affected system. The vulnerability is exploitable remotely without authentication or user interaction, increasing its risk. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the pagemanager/pagebuilder module and implement network-level controls to limit exposure. Monitor for suspicious file uploads and consider disabling file upload functionality if not required. Avoid deploying the affected version in production environments where possible.