Page Builder CK — fonts.save RCE Probe CVE-2026-56290

BlackHat Team proof-of-concept scanner for the Joomla Page Builder CK fonts.save vulnerability. POC CVE-2026-56290

Author: @mrzblackhat
Team: BlackHat Team
Credits: Peyman Siyahi · MR.PERSIA

Overview

This tool probes Joomla sites running the vulnerable com_pagebuilderck component. It abuses the fonts.save task to pull a remote payload and writes a web shell under:

media/com_pagebuilderck/gfonts/fbi.php

RCE is confirmed when the uploaded shell responds with an HTML <title> containing Fbi Shell.

Supports single-target and mass scanning with threaded workers and instant hit saving.

Requirements

• Python 3.10+
• requests
• urllib3

pip install requests urllib3

Usage

Single target

python3 poc.py --url https://example.com --insecure

Mass scan

python3 poc.py --mass targets.txt --insecure --threads 20 --timeout 12

targets.txt — one URL per line. Lines after # are ignored.

Options

Output

• HIT — shell uploaded and PHP executed; title contains Fbi Shell
• PART — file written but PHP not executed
• MISS — exploit not confirmed

Confirmed shell URLs are appended to the output file immediately.

Project files

Rebuild after editing source

python3 _build_obf.py

How it works

1. Fetch homepage and extract Joomla CSRF token
2. POST to index.php with option=com_pagebuilderck&task=fonts.save
3. Remote font.css callback triggers shell write to gfonts/fbi.php
4. GET the shell path and verify <title> contains Fbi Shell

Disclaimer

This tool is provided for authorized security research and penetration testing only.

Unauthorized access to computer systems is illegal. The authors and BlackHat Team are not responsible for misuse. Only test systems you own or have explicit written permission to assess.

Contact

• Telegram: https://t.me/mrzblackhat
• Handle: @mrzblackhat

BlackHat Team — Peyman Siyahi · MR.PERSIA

Original research and tooling by @mrzblackhat. Do not redistribute modified copies without attribution.