Joomla Content Editor (JCE) versions 1.0.0 through 2.9.99.4 are affected by CVE-2026-48907. An unauthenticated attacker can create an editor profile and ultimately upload and execute PHP. Joomla's CNA rates it CVSS v4.0 10.0 CRITICAL with exploit maturity ATTACKED.
Vulnerability Overview and Scope of Impact
The affected range is JCE 1.0.0 through 2.9.99.4. Consult JCE's security-update notice for the currently fixed release or the official patch for older sites. Do not infer a fixed version from a home page or search result.
If this vulnerability is exploited, attackers can achieve full compromise of a Joomla site. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
Specific Impact and Attack Scenario
An unauthenticated attacker can create a new JCE editor profile and ultimately upload and execute PHP. Successful exploitation compromises the confidentiality, integrity, and availability of the Joomla site and data reachable by the web-server account. Specific request paths and payload details are unnecessary for remediation and are omitted.
Immediate Actions for Engineers
Install the fixed release or official patch, then review editor profiles, Joomla administrators, uploaded PHP, unexpected extensions, and web-server logs. If compromise is suspected, rotate credentials and restore a known-good state. Do not substitute a generic web-server rule for the official patch.
📦