Security readout for executives and security teams
Plain-English summary
Page Builder CK for Joomla contains an access-control weakness that lets a low-privileged authenticated user upload arbitrary files. Successful abuse can result in remote code execution, potentially allowing full website and server compromise. The supplied evidence identifies specific affected version ranges but does not identify a confirmed fixed release.
Executive priority
Treat this as an urgent remediation item for internet-facing or business-critical Joomla sites. Authenticated access is required, but low privileges and potential server compromise make credential theft or misuse consequential. Prioritize inventory, vendor-confirmed updating, access restriction, and compromise review.
Technical view
CVE-2026-63048 is a CWE-434 arbitrary-file-upload vulnerability caused by improper access control. It is network-accessible, requires low privileges, needs no user interaction, and can lead to remote code execution. CVSS 4.0 rates it 9.4 with high confidentiality, integrity, and availability impacts across vulnerable and subsequent systems.
Likely exposure
Exposure exists where Joomla runs Page Builder CK versions 1.0.0–3.1.2, 3.4.0–3.4.11, or 3.5.0–3.6.2 and untrusted or compromised users can authenticate. Internet-facing sites and environments with broadly assigned Joomla accounts warrant especially prompt review.
Exploitation context
The supplied record says exploitation requires an authenticated, low-privileged account and no user interaction. Arbitrary file upload can lead to remote code execution. The bundle reports that this CVE is not in KEV and provides no evidence of active exploitation or public exploit availability.
Researcher notes
The source bundle provides affected ranges, CVSS 4.0 scoring, CWE-434 classification, and the authenticated-upload-to-RCE outcome. It does not describe the vulnerable endpoint, required Joomla role, upload restrictions, fixed version, patch, indicators of compromise, or observed exploitation. Avoid assuming those details without further vendor evidence.
Mitigation direction
- Inventory Joomla sites and identify installed Page Builder CK versions.
- Check current vendor guidance for a confirmed fixed or unaffected release.
- Update after confirming the target release is outside every affected range.
- Disable or remove the extension where updating cannot be completed promptly.
- Restrict Joomla accounts and extension access to trusted users until remediation.
Validation and detection
- Confirm the installed extension version against all listed affected ranges.
- Review Joomla accounts for unexpected, dormant, or unnecessarily privileged access.
- Inspect recent extension upload activity and server logs for unexplained file creation.
- Check web-accessible directories for unexpected executable files or unauthorized modifications.
- After remediation, verify the vulnerable version is absent from every Joomla instance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-63048 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.4 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——JoomlaVulnerability scoring details
Base CVSS 4.0 score
9.4CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.joomlack.fr/CVE reference, Joomla · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.