{"id":"joomla-jce-profile-upload-attacks-jun-2026","category":"patch","status":"closed","title":"Joomla Content Editor profile upload flaw CVE-2026-48907 exploited to take over websites; fix available","tldr":"Attackers are exploiting Joomla Content Editor to run code on websites without logging in. Ask your website manager to update JCE and check for existing backdoors: updating alone does not clean an infected site.","summary":"CVE-2026-48907 affects Joomla Content Editor (JCE), an extension used to edit Joomla websites. Missing access checks let attackers without an account introduce editor profiles that enable executable PHP uploads, potentially taking over the website. JCE 2.9.99.5 fixed the flaw on 3 June; subsequent releases added hardening. CISA confirmed exploitation in June, and Italy’s CSIRT reported increased attacks involving backdoors and website defacement in September. The Joomla CVE record lists versions 1.0.0–2.9.99.4 as affected, but the developer’s later guidance says 2.6.x does not appear vulnerable in its default configuration; that exception has not been independently verified. A free stopgap patch covers older 2.7.x, 2.8.x and 2.9.x installations. As at 3 November, fixes are available, but updating does not remove an attacker’s existing access. No end to exploitation has been established.","action":"If your family, business or charity runs a Joomla website, ask its manager to install the latest compatible JCE release; 2.9.99.12 is the latest listed 2.x release. Ask them to check for unauthorised profiles and malicious files, and clean any compromise. If updating is impossible, use the vendor’s free legacy patch as a stopgap, or uninstall JCE if neither option is possible.","product":"Joomla Content Editor (JCE Free and Pro)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-48907"],"tags":["widget-factory","joomla","jce","access-control","remote-code-execution","actively-exploited"],"affected":["Joomla CNA record: JCE 1.0.0–2.9.99.4.","Vendor clarification: JCE 2.6.x does not appear affected in its default configuration, but this has not been independently verified; the branch is unsupported."],"fixed":["JCE 2.9.99.5 and later.","Vendor free patch package for JCE 2.7.x, 2.8.x and 2.9.x; fixes this vulnerability without the additional hardening in later releases."],"matches":[],"sources":[{"kind":"advisory","title":"JCE security update, and a free patch for older sites","url":"https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites","by":"Widget Factory","date":"2026-06-12"},{"kind":"advisory","title":"JCE Editor 2.x changelog","url":"https://www.joomlacontenteditor.net/support/changelog/editor","by":"Widget Factory","date":"2026-10-07"},{"kind":"advisory","title":"CVE-2026-48907: Joomla CNA record and CISA exploitation confirmation","url":"https://cveawg.mitre.org/api/cve/CVE-2026-48907","by":"Joomla and CISA","date":"2026-06-20"},{"kind":"advisory","title":"Joomla JCE: exploitation of CVE-2026-48907 to deploy backdoors used for website defacement","url":"https://csirt.regione.toscana.it/joomla-jce-rilevato-sfruttamento-cve-2026-48907-al-fine-di-distribuire-webshell-utilizzate-per-defacement-bl01-260917-csirt-ita/","by":"CSIRT Toscana, republishing CSIRT Italia","date":"2026-09-17"}],"started":"2026-06-03","closed":"2026-10-07","created":"2026-11-03T22:19:12.113Z","updated":"2026-11-03T22:19:12.113Z","cve_notes":[{"cve":"CVE-2026-48907","name":"Unauthenticated profile upload in Joomla Content Editor","what":"Missing access checks in JCE’s editor-profile import function let attackers without a login introduce profiles that enable PHP uploads and code execution on the website’s server.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-10-07","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Widget Factory released JCE 2.9.99.12, a later maintenance update in the patched 2.x line.","url":"https://www.joomlacontenteditor.net/support/changelog/editor","by":"Widget Factory","patch":null},{"at":"2026-09-17","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Italy’s CSIRT reported a significant increase in exploitation against exposed web servers. Almost all observed incidents involved planting backdoors subsequently used to alter websites.","url":"https://csirt.regione.toscana.it/joomla-jce-rilevato-sfruttamento-cve-2026-48907-al-fine-di-distribuire-webshell-utilizzate-per-defacement-bl01-260917-csirt-ita/","by":"CSIRT Toscana, republishing CSIRT Italia","patch":null},{"at":"2026-06-18","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"JCE 2.9.99.7 further hardened uploads and profile imports, added restrictions on eligible user groups, and corrected checks that rejected legitimate files.","url":"https://www.joomlacontenteditor.net/support/changelog/editor","by":"Widget Factory","patch":null},{"at":"2026-06-16","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-48907 to its Known Exploited Vulnerabilities catalogue, confirming exploitation.","url":"https://cveawg.mitre.org/api/cve/CVE-2026-48907","by":"Joomla and CISA","patch":null},{"at":"2026-06-08","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"JCE 2.9.99.6 added broader checks on access, incoming data and file handling.","url":"https://www.joomlacontenteditor.net/support/changelog/editor","by":"Widget Factory","patch":null},{"at":"2026-06-05","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Joomla published CVE-2026-48907, describing how unauthorised editor profiles could enable PHP file upload and execution.","url":"https://cveawg.mitre.org/api/cve/CVE-2026-48907","by":"Joomla","patch":null},{"at":"2026-06-03","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Widget Factory released JCE 2.9.99.5, fixing missing access checks that allowed people without a login to upload editor profiles.","url":"https://www.joomlacontenteditor.net/support/changelog/editor","by":"Widget Factory","patch":"patched"}],"url":"https://hard.fyi/live/joomla-jce-profile-upload-attacks-jun-2026/","json":"https://hard.fyi/api/live?id=joomla-jce-profile-upload-attacks-jun-2026"}