
Proof-of-concept for CVE-2026-39292: arbitrary file upload vulnerability in Falco Solutions PHPPageBuilder v0.31.0 enabling remote code execution via the pagemanager/pagebuilder module.
Title: CVE-2026-39292 – Arbitrary File Upload leading to RCE in Falco Solutions PHPPageBuilder v0.31.0
Summary: A file upload vulnerability in the pagemanager/pagebuilder module allows authenticated/unauthenticated attackers to upload arbitrary files resulting in remote code execution.
Affected Version: PHPPageBuilder v0.31.0
Impact: Remote Code Execution
Vendor: Falco Solutions
Credits: Discovered by Krishnadev P Melevila