Remote code execution affecting Joomla Content Editor (JCE)
A vulnerability affecting the Joomla Content Editor (JCE) extension of the Joomla Framework would allow an unauthenticated attacker to remotely execute code on affected systems.
Description
Technical context and vulnerability details
Joomla Content Editor (JCE) is a popular Joomla CMS extension, dedicated to advanced content creation and editing. This extension is affected by a vulnerability labeled CVE-2026-48907 resulting from a lack of access control on the profile import functionality. Exploitation of this vulnerability would allow an unauthenticated attacker to bypass file extension filtering in order to upload and execute a malicious PHP file in directories on the affected site. It is classified critical with a severity score of 9.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Execution of arbitrary code without authentication;
- Total takeover of the web server hosting the application;
- Breach of confidentiality and availability of data;
- Compromise of system integrity;
Affected systems
Products, components and targeted versions
- All versions of the JCE extension of Joomla prior to version 2.9.99.5;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update the JCE extension to the latest stable version available;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.