CVE-2026-48907

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

State: Published
Severity: 10.0 Critical
Published: Jun 5, 2026
Updated: Jun 20, 2026
Reserved: May 26, 2026

Description

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.

Scores

CVSS	Score	Vector	Source
4.0	10.0 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red	Joomla

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
Joomla Content Editor (JCE) extension for Joomlajoomlacontenteditor.net	1.0.0-2.9.99.4Affected

References

https://www.joomlacontenteditor.net/product
https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sitesvendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48907government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.