The Joomla extension Page Builder CK for Joomla contains an improper access control flaw that permits unauthenticated users to upload arbitrary files, including executable scripts, which are then executed by the web server. Attackers can therefore achieve full remote code execution on the host system.

All installations of the joomlack.fr Page Builder CK extension for Joomla that are running any version prior to 3.6.0 are vulnerable. Site administrators who have not upgraded to the patched version cannot be assured of security.

The vulnerability scores a CVSS 10, indicating critical severity. While EPSS data is not available, the flaw’s unauthenticated exploitation path suggests a high likelihood of real‑world attacks. It is not yet listed in the CISA KEV catalog. Attackers can send crafted HTTP requests to the extension’s upload endpoint from any network accessible location, upload malicious scripts, and then trigger their execution with the web server’s privileges.