CVE-2026-48907criticalunder attackCWE-284

CVE-2026-48907: critical vulnerability in joomlacontenteditor.net Joomla Content Editor…

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

Published · Updated

Follow this CVE+ Monitor Joomla Content Editor extension for Joomla+ Monitor Joomla Content Editor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.

ssvc Actcvss 10epss 85%
from disclosure to weapon4 days
Published on NVDJun 5
1st PoC+4d
metasploitJun 5
CISA KEV+11d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 56/2026 · 10 Jul 2026Vulnerabilidade crítica com exploração ativa no Joomla JCEread on gov.br ↗
  • CISC Gov.br · 16 Jun 2026RCE Pré-autenticado no JCE Pro — CVE-2026-48907read on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2026-06-19

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

The JCE editor extension for Joomla allows anyone, even without logging in, to create new editor profiles that can lead to uploading and running harmful PHP code on the website. This gives attackers complete control over the server.

Technical detail

The vulnerability enables unauthenticated users to create arbitrary editor profiles in the JCE extension, which can be abused to upload and execute PHP code on the server. The attack requires no authentication and results in remote code execution with full server privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
Affected products
joomlacontenteditor.net · Joomla Content Editor (JCE) extension for Joomla
public PoCs found — 51
exploitdbwww.exploit-db.com/exploits/52645unverifiedexploitdbwww.exploit-db.com/exploits/52630unverifiedgithubgithub.com/gh1mau/masta-cve-2026-48907★ 64githubgithub.com/ywh-jfellus/CVE-2026-48907★ 16githubgithub.com/K3ysTr0K3R/CVE-2026-48907★ 4githubgithub.com/ashrafzaryouh/CVE-2026-48907★ 3githubgithub.com/0xBlackash/CVE-2026-48907★ 3githubgithub.com/0xgh057r3c0n/CVE-2026-48907★ 2githubgithub.com/NONAME-ELV/CVE-2026-48907★ 1githubgithub.com/g0thamRabb1t/CVE-2026-48907-Joomla-JCE-detection★ 1githubgithub.com/amnsecurity/CVE-2026-48907-Joomla-JCE-RCE★ 1githubgithub.com/pssec-io/CVE-2026-48907★ 1githubgithub.com/webshellseo8/CVE-2026-48907-Unauthenticated-RCE-in-JCE★ 1githubgithub.com/sec0x/CVE-2026-48907★ 1githubgithub.com/ChiefYoru/CVE-2026-48907_PoC★ 1githubgithub.com/BastianHxr/CVE-2026-48907★ 1githubgithub.com/0xCyp1337/CVE-2026-48907-RCE★ 1githubgithub.com/HORKimhab/CVE-2026-48907★ 0githubgithub.com/grayxploit/CVE-2026-48907★ 0githubgithub.com/xitexploiter96-dot/CVE-2026-48907-★ 0githubgithub.com/ksotaria1337/-CVE-2026-48907-★ 0githubgithub.com/87achrafg-stack/CVE-2026-48907★ 0githubgithub.com/g0thamRabb1t/joomla-jce-cve-2026-48907-detection★ 0githubgithub.com/Almavj/Joomla_CVE_2026_48907★ 0githubgithub.com/NoXiVaR/CVE-2026-48907★ 0githubgithub.com/theendofabbys/CVE-2026-48907★ 0githubgithub.com/wearehackers160/CVE-2026-48907★ 0githubgithub.com/CerberusMrXi/JCEzploit-CVE-2026-48907★ 0githubgithub.com/CoNistical/CVE-2026-48907★ 0githubgithub.com/bayu06802/CVE-2026-48907★ 0vulncheckvulncheck.com/xdb/8aea764423e4unverifiedvulncheckvulncheck.com/xdb/4fb98049078dunverifiedvulncheckvulncheck.com/xdb/fe6a20a4dab4unverifiedvulncheckvulncheck.com/xdb/8f852dc50830unverifiedvulncheckvulncheck.com/xdb/df10c0c1a5fbunverifiedvulncheckvulncheck.com/xdb/c8ea4f263e83unverifiedvulncheckvulncheck.com/xdb/584961b43d7cunverifiedvulncheckvulncheck.com/xdb/bf9f910c249eunverifiedvulncheckvulncheck.com/xdb/34872eebf6baunverifiedvulncheckvulncheck.com/xdb/f624442bb47cunverifiedvulncheckvulncheck.com/xdb/bb03ef2631d1unverifiedvulncheckvulncheck.com/xdb/7b5f88d13907unverifiedvulncheckvulncheck.com/xdb/609673988f8eunverifiedvulncheckvulncheck.com/xdb/ba4be0ffd1eeunverifiedvulncheckvulncheck.com/xdb/f459dd355b00unverifiedvulncheckvulncheck.com/xdb/30044911c5a5unverifiedvulncheckvulncheck.com/xdb/c0936cc796c9unverifiedvulncheckvulncheck.com/xdb/413b55dc5574unverifiedvulncheckvulncheck.com/xdb/ea98edc9d14eunverifiedvulncheckvulncheck.com/xdb/3346a89083f0unverifiedvulncheckvulncheck.com/xdb/d0682c028430unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — joomlacontenteditor.net Joomla Content Editor…

In the same product, most dangerous first.

CVE-2026-65891MEDIUMJoomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.9.99.10EPSS 0.3%