by Kastro
Paper/Archive/CVE-2026-48907

CVE-2026-48907

joomlacontenteditor.net Joomla Content Editor (JCE) extension for Joomla — Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

KEV · due 19 JunEPSS 85%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 99.7.997 × 2019.9Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.

Affected

ProductAffectedFixed inSource
Joomla Content Editor (JCE) extension for Joomla1.0.0-2.9.99.4–CNA

Scores by source

Joomla (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refjoomlacontenteditor.netadvisoryjoomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sitesrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48907kevcisa.gov/known-exploited-vulnerabilities-catalog