Critical Vulnerability Discovered in Joomlack Page Builder

What changed

The Joomlack Page Builder, a widely used Joomla extension, has been found to have a significant vulnerability related to improper access control. This flaw allows unauthorized users to upload arbitrary files, including executable ones, which can ultimately lead to remote code execution (RCE).

This vulnerability affects versions of the Page Builder CK extension prior to 3.6.0, posing a serious risk to users who have not yet updated.

Who is affected

Several groups and products are at risk due to this vulnerability in the Joomlack Page Builder. It is crucial for users and organizations utilizing this extension to be aware of the potential threats.

The following are particularly vulnerable:

• Users of the Joomlack Page Builder CK extension, especially those running versions below 3.6.0.
• Websites built on Joomla that utilize this extension for content management.
• Developers and site administrators who have not implemented security measures against unauthorized file uploads.

What to do

To mitigate the risks associated with this vulnerability, immediate action is recommended. Users should prioritize updating their extensions to the latest version.

Additionally, implementing robust access controls and monitoring file uploads can help prevent exploitation.

• Upgrade the Page Builder CK extension to version 3.6.0 or later as soon as possible.
• Review and enhance security protocols related to file uploads on Joomla sites.
• Regularly audit installed extensions for vulnerabilities to maintain a secure environment.