CVE-2026-56290: Page Builder CK unauthenticated arbitrary file upload to RCE (REPRO-2026-00232)

Pruva

Verified reproduction

CVE-2026-56290: Page Builder CK unauthenticated arbitrary file upload to RCE

CVE-2026-56290 is verified against the affected target vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00232.

REPRO-2026-00232 RCE Variant found Jul 6, 2026 .txt

Severity CRITICAL

Confidence HIGH

Reproduced in 23m 44s

Tool calls 253

Spend $5.21

01 · Reproduce

Download script Open in Codespaces → Variant script

$ pruva-verify REPRO-2026-00232

or

curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00232/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh

Run in a VM or disposable container. This exploits a real vulnerability.

02 · The vulnerability

The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that can lead to remote code execution. Reproduce: install Joomla with the vulnerable Page Builder CK extension, send an unauthenticated request that uploads a web shell, and access it to execute code.

03 · Root cause

Variant analysis

04 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.

Loading session...

05 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.

bundle/artifact_promotion_manifest.json8.4 KB

bundle/vuln_variant/source_identity.json0.9 KB

bundle/vuln_variant/root_cause_equivalence.json1.6 KB

bundle/logs/rce_vulnerable_output.txt0.1 KB

bundle/logs/upload_vulnerable_response.txt0.2 KB

bundle/logs/upload_fixed_response.txt4.0 KB

bundle/logs/exploit_shell.php0.1 KB

bundle/logs/evidence.log13.0 KB

bundle/repro/runtime_manifest.json0.6 KB