home / blog
2026-10-29 · critical
CVE-2026-48907: Critical Flaw in Joomla JCE Editor
Critical flaw in Joomla JCE: unauthenticated profile creation enables PHP upload.
CVE-2026-48907 affects the JCE editor extension for Joomla, a widely used add-on for content management on this CMS. The issue allows an unauthenticated user to create new editor profiles, paving the way for PHP code upload and execution on the compromised server.
NVD data assigns this vulnerability a CVSS score of 9.8, placing it in the critical range. The flaw was published on June 5, 2026. On October 29, 2026, signals were observed regarding public repositories claiming to contain exploits: an indicator of security community interest, not confirmation of active exploitation, which is not confirmed in the available data.
Given the critical severity and the possibility of unauthenticated code execution, administrators running Joomla with JCE should prioritize checking their installed version and consult official sources for available patches. Lacking details on affected versions and fixes, compensating controls are recommended: restrict administrative access, monitor for new editor profiles and unexpected PHP files, and follow Joomla and extension security advisories.
At a glance
- What
- The vulnerability affects the JCE editor extension for Joomla and allows unauthenticated users to create new editor profiles, ultimately enabling PHP code upload and execution.
- Severity
- CVSS 9.8, classified as critical according to NVD data.
- Affected versions
- Not reported in the available data.
- Fix
- Not reported in the available data; administrators should check the JCE developer's official advisories.
- Status
- Published on NVD on June 5, 2026; public repositories claiming to contain exploits were observed on October 29, 2026. Active exploitation in the wild is not confirmed.
- Action
- Verify the installed JCE extension version, check for official updates, restrict administrative access, and monitor logs for anomalous editor profile creation or suspicious file uploads.
Sources: NVD, CVE-2026-48907