Loading vulnerability…
Unauthenticated Remote Code Execution in Joomla Content Editor
CVE-2026-48907 is an improper access control vulnerability in the Joomla Content Editor (JCE) extension for Joomla. Inadequate authorization of the editor-profile import functionality, combined with insufficient uploaded-file validation, allows remote unauthenticated attackers to create unauthorized editor profiles and bypass upload restrictions. Attackers can enable PHP uploads, place executable PHP content in web-accessible locations, and execute arbitrary code on the hosting server. Public proof-of-concept exploits exist, and the vulnerability has been exploited at scale to deploy webshells and deface websites.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of the affected Joomla installation and data accessible to its web-server process. Attackers can execute arbitrary PHP, modify website content, access sensitive data, and establish persistent access through webshells or malicious Joomla extensions. Observed exploitation includes persistent uploader deployment and website defacement. Broader hosting-environment compromise and lateral movement are possible depending on process permissions and network access; operating-system administrator privileges are not established by this vulnerability alone.
If you can’t patch tonight, do this now.
Disable or restrict access to the vulnerable extension until patched. Prevent PHP execution in temporary and upload directories, restrict web access to temporary storage, remove executable file types from permitted JCE uploads, and place upload destinations outside the web root where possible. Review profile configurations, web-server logs, and recently created or modified executable files for evidence of exploitation. Restrict communication between public web servers and internal systems to limit post-compromise movement.
Patch, then assume compromise.
Upgrade JCE to version 2.9.99.9 or later, preferably the latest supported release. The minimum fixed-version boundary is inconsistent across the available advisories: some identify 2.9.99.5 as fixed, while another includes that version among affected releases and recommends 2.9.99.6 or later. For legacy deployments unable to meet the PHP 7.4 or later requirement of JCE 2.9.99.6, a vendor patch is available for the JCE 2.7.x, 2.8.x, and 2.9.x branches; it fixes this vulnerability without the additional hardening in newer releases. Audit and remove unauthorized editor profiles and malicious extensions. If compromise is suspected, isolate the host, preserve forensic evidence, investigate unauthorized files and accounts, and restore from a known-good image when necessary. Patching alone does not remove existing backdoors.
23 exploits validated by Mallory's analysis. Hidden: 5 rejected by Mallory's analysis as not a working exploit; 3 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
150 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.