The Joomla extension Page Builder CK (joomlack.fr) versions up to 3.6.2 suffer from CWE-434: Unrestricted Upload of File with Dangerous Type. Due to improper access control, an authenticated attacker can upload arbitrary files, potentially leading to remote code execution. The vulnerability has a CVSS 4.0 base score of 9.4, indicating critical severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, availability, and security requirements. No official patch or remediation level is currently documented in the vendor advisory or CVE data.

An authenticated attacker can upload arbitrary files, including potentially malicious scripts, leading to remote code execution on the server hosting the Joomla extension. This compromises the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to trusted users only and monitor for suspicious file uploads. Avoid exposing the vulnerable extension to untrusted users.