Joomla! JCE extension < 2.9.99.5 unauthenticated RCE
CVE-2026-48907
Verified
Description
Joomla JCE editor extension contains an unrestricted file upload vulnerability caused by allowing unauthenticated users to create new editor profiles, letting attackers upload and execute PHP code remotely, exploit requires no authentication.
Severity
Critical
CVSS Score
10
Exploit Probability
16%
Affected Product
jce
Published Date
June 11, 2026
Template Author
ywh-jfellus
CVE-2026-48907.yaml
10.0Score
CVSS Metrics
CVSS Vector:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-48907
CWE ID:
cwe-284
Remediation Steps
Update to the latest version of the JCE editor extension.