Remote code execution affecting JCE for Joomla
A critical vulnerability affecting JCE for Joomla would allow an unauthenticated malicious actor to create an editor profile allowing them to upload and execute malicious PHP code leading to the compromise of the server hosting the vulnerable instance.
Description
Technical context and vulnerability details
JCE (Joomla Content Editor) is an advanced content editor integrated into Joomla that allows users to easily create, modify and manage website content including text, images and files. This editor is affected by a vulnerability labeled CVE-2026-48907, resulting from insufficient authentication as well as inadequate protection against CSRF (Cross-Site Request Forgery) attacks. Exploitation of this vulnerability would allow an unauthenticated attacker to upload a crafted XML file containing malicious PHP code in order to perform arbitrary remote code execution on the affected server. It is classified critical with a severity score of 9.8 according to CVSS V3.1
Potential Risks & Impact
Potential consequences upon exploitation
- Arbitrary code execution;
- Breach of data availability;
- Data privacy breach;
- Violation of the integrity of accounts and services;
- Compromising interface integrity;
Affected systems
Products, components and targeted versions
- Versions of JCE for Joomla prior to or equal to version 2.9.99.5;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update JCE for Joomla to version 2.9.99.6 or later;
- Check existing JCE profiles and delete any unknown profiles;
- Disable PHP execution in /tmp/ and upload directories, to limit the impact of a possible malicious code submission;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.