Page Builder CK CVE-2026-56290

No vendor-released patch version is identified in the available data; the only reference is the vendor site https://www.joomlack.fr/, which should be checked for an updated Page Builder CK release and applied immediately once available. Until a fixed version is confirmed, the most effective compensating control is to remove or disable the Page Builder CK extension via the Joomla administrator Extensions manager, accepting that pages built with it may stop rendering. If removal is not acceptable, block external access to the extension's upload/file-handling endpoints at the web server or WAF layer and add a rule denying PHP execution within Joomla upload/media directories (e.g. via httpd/nginx config removing the PHP handler in those paths), which neutralizes a planted webshell at the cost of breaking any legitimate uploaded-script behavior. Also restrict administrator and component access by IP where feasible, and after patching, audit the webroot and media folders for unexpected PHP files that may indicate prior compromise.