NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Joomla Content Editor profile upload flaw CVE-2026-48907 exploited to take over websites; fix available

Attackers are exploiting Joomla Content Editor to run code on websites without logging in. Ask your website manager to update JCE and check for existing backdoors: updating alone does not clean an infected site.

What to do

If your family, business or charity runs a Joomla website, ask its manager to install the latest compatible JCE release; 2.9.99.12 is the latest listed 2.x release. Ask them to check for unauthorised profiles and malicious files, and clean any compromise. If updating is impossible, use the vendor’s free legacy patch as a stopgap, or uninstall JCE if neither option is possible.

What’s happening

CVE-2026-48907 affects Joomla Content Editor (JCE), an extension used to edit Joomla websites. Missing access checks let attackers without an account introduce editor profiles that enable executable PHP uploads, potentially taking over the website. JCE 2.9.99.5 fixed the flaw on 3 June; subsequent releases added hardening. CISA confirmed exploitation in June, and Italy’s CSIRT reported increased attacks involving backdoors and website defacement in September. The Joomla CVE record lists versions 1.0.0–2.9.99.4 as affected, but the developer’s later guidance says 2.6.x does not appear vulnerable in its default configuration; that exception has not been independently verified. A free stopgap patch covers older 2.7.x, 2.8.x and 2.9.x installations. As at 3 November, fixes are available, but updating does not remove an attacker’s existing access. No end to exploitation has been established.

What
Flaw
Affects
Joomla Content Editor (JCE Free and Pro)
Affected
Joomla CNA record: JCE 1.0.0–2.9.99.4.
Vendor clarification: JCE 2.6.x does not appear affected in its default configuration, but this has not been independently verified; the branch is unsupported.
Fixed in
JCE 2.9.99.5 and later.
Vendor free patch package for JCE 2.7.x, 2.8.x and 2.9.x; fixes this vulnerability without the additional hardening in later releases.
CVE
CVE-2026-48907
Since
3 June 2026
Closed
7 Oct 2026

Timeline

  1. Update

    Widget Factory released JCE 2.9.99.12, a later maintenance update in the patched 2.x line.

  2. Wider attacks

    Italy’s CSIRT reported a significant increase in exploitation against exposed web servers. Almost all observed incidents involved planting backdoors subsequently used to alter websites.

  3. New fix

    JCE 2.9.99.7 further hardened uploads and profile imports, added restrictions on eligible user groups, and corrected checks that rejected legitimate files.

  4. CISA added

    CISA added CVE-2026-48907 to its Known Exploited Vulnerabilities catalogue, confirming exploitation.

  5. New fix

    JCE 2.9.99.6 added broader checks on access, incoming data and file handling.

  6. Made public

    Joomla published CVE-2026-48907, describing how unauthorised editor profiles could enable PHP file upload and execution.

  7. New fixFixed

    Widget Factory released JCE 2.9.99.5, fixing missing access checks that allowed people without a login to upload editor profiles.

Sources

  1. JCE security update, and a free patch for older sitesWidget Factory · 12 June 2026
  2. JCE Editor 2.x changelogWidget Factory · 7 Oct 2026
  3. CVE-2026-48907: Joomla CNA record and CISA exploitation confirmationJoomla and CISA · 20 June 2026
  4. Joomla JCE: exploitation of CVE-2026-48907 to deploy backdoors used for website defacementCSIRT Toscana, republishing CSIRT Italia · 17 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from June 2026 · JSON · RSS