What is the CVSS score of CVE-2026-39292?

CVE-2026-39292 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHPageBuilder are affected by CVE-2026-39292?

PHPageBuilder v0.31.0 contains an unauthenticated remote code execution vulnerability in its file upload mechanism, allowing attackers without credentials to execute arbitrary code on affected web…

How to fix or mitigate CVE-2026-39292?

24 hours: Inventory all instances of PHPageBuilder v0.31.0 and assess internet exposure; isolate affected systems from critical networks if possible. 7 days: Disable the pagemanager/pagebuilder file upload module or remove it entirely; deploy Web Application Firewall rules to block file uploads to the vulnerable endpoint. 30 days: Evaluate alternative page-building solutions; execute migration or plan upgrade once vendor releases patched version.

PHPageBuilder CVE-2026-39292

EUVD-2026-33329 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-29 mitre

GHSA-gqvc-rhwj-m45g

File Upload RCE N A

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 23:30 vuln.today

CVSS changed

Jun 01, 2026 - 21:22 NVD

7.3 (HIGH)

CVE Published

May 29, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Falco Solutions PHPPageBuilder v0.31.0 contains an unrestricted file upload vulnerability in the pagemanager/pagebuilder module that allows remote attackers to upload arbitrary files and achieve remote code execution. The vulnerability exists due to insufficient validation of uploaded file types and executable content.

AnalysisAI

Remote code execution in Falco Solutions PHPageBuilder v0.31.0 is possible through an unrestricted file upload flaw in the pagemanager/pagebuilder module, enabling unauthenticated remote attackers to upload arbitrary executable files (typically PHP webshells) and run code on the underlying web server. Publicly available exploit code exists in a dedicated GitHub repository, though EPSS scoring (0.06%, 18th percentile) and SSVC indicate no observed in-the-wild exploitation despite the attack being fully automatable.

Technical ContextAI

PHPageBuilder is an open-source PHP-based drag-and-drop website builder maintained on GitHub (HansSchouten/PHPageBuilder) and distributed by Falco Solutions. The vulnerable component is the pagemanager/pagebuilder module, which accepts file uploads from administrative or page-editing workflows. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type) - the upload handler fails to validate file extension, MIME type, magic bytes, or content for executable script payloads, allowing files such as .php, .phtml, or polyglot files to be written into a web-accessible directory and subsequently executed by the PHP interpreter when requested.

RemediationAI

No vendor-released patch identified at time of analysis - neither the CVE references nor the EUVD entry cite a fixed version or commit, so administrators should monitor https://github.com/HansSchouten/PHPageBuilder for an upstream release superseding 0.31.0. As compensating controls, restrict access to the pagemanager/pagebuilder module to trusted administrators via web-server-level authentication (HTTP basic auth, IP allowlisting, or VPN-only access), which removes unauthenticated reachability at the cost of slightly more friction for legitimate editors. Configure the web server to disallow PHP execution in any upload/storage directory (for example, an Apache 'php_flag engine off' or nginx 'location' block stripping the PHP handler) to neutralize uploaded webshells even if the validation flaw is triggered. Additionally deploy a WAF rule blocking multipart uploads to the pagemanager/pagebuilder endpoint where file extensions match php/phtml/phar/htaccess, and audit existing upload directories for unexpected scripts. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-39292.