CVE-2026-56290 is a critical vulnerability in the JoomlaCK.fr Page Builder CK extension for Joomla, affecting versions 1.0 up to and including 3.6.0. It allows unauthenticated attackers to upload files of dangerous types without restriction, enabling arbitrary file upload. This flaw leads to full remote code execution on the target system. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and has a CVSS 4.0 score of 10, indicating maximum severity. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to upload executable files, resulting in full remote code execution on affected Joomla installations using the vulnerable Page Builder CK extension. This can lead to complete system compromise, data breach, or further malicious activity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable extension, disable file uploads if possible, and monitor for suspicious activity related to file uploads.