CVE-2026-39292 File upload in n/a
Remote attackers can upload arbitrary files to achieve remote code execution due to insufficient validation in PHPPageBuilder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-39292?
CVE-2026-39292 is a high-severity vulnerability in n/a, published on 29 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Falco Solutions PHPPageBuilder v0.31.0 contains an unrestricted file upload vulnerability in the pagemanager/pagebuilder module that allows remote attackers to upload arbitrary files and achieve remote code execution. The vulnerability exists due to insufficient validation of uploaded file types and executable content.
Weakness: CWE-434
Which versions are affected by CVE-2026-39292?
How do I fix CVE-2026-39292?
No fix has been published for CVE-2026-39292 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-39292 being exploited?
There is no known exploitation of CVE-2026-39292 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-gqvc-rhwj-m45g.