Page Builder CK CVE-2026-63048

No specific fixed version was provided in the source data, so the primary action is to consult the vendor at https://www.joomlack.fr/ (and the Joomla extensions directory / Vulnerable Extensions List) for the patched Page Builder CK release and upgrade once identified - patch availability could not be confirmed from the input, so treat this as no vendor-released patch identified at time of analysis pending vendor confirmation. As compensating controls until a patched build is applied: restrict which Joomla user groups can access Page Builder CK's editing and upload features so untrusted or self-registered accounts cannot reach the upload endpoint (trade-off: reduces content-editing convenience for legitimate authors); disable public self-service account registration in Joomla Global Configuration to preserve the PR:L barrier (trade-off: blocks legitimate new users); and configure the web server to deny PHP execution within Joomla upload/media directories via an .htaccess or server block that disables the PHP handler for those paths (trade-off: breaks any legitimate feature that executes files from those directories). A WAF rule blocking uploads of executable extensions to the extension's endpoints adds defense but may be bypassable and can cause false positives.