Joomla JCE Editor: Critical RCE Flaw Without Login (CVE-2026-48907)

Published on 2 August 2026

Three simple HTTP requests. No username, no password, no login – and an attacker has full control over your web server. That is exactly what a critical vulnerability in the Joomla Content Editor (JCE), the most widely used editor extension in the Joomla ecosystem, makes possible. The flaw carries the identifier CVE-2026-48907, reaches the highest possible severity with a CVSS score of 10.0, and is demonstrably already being exploited actively and in an automated fashion. An estimated 2.5 million Joomla installations worldwide are affected – and Germany is by far the most heavily impacted country.

If you run a Joomla website and use the JCE editor, do not let this article sit until the weekend. We explain what happened, whether you are affected, and what specific steps you need to take now.

What happened?

The Joomla Content Editor – JCE for short – is an extension that lets editors conveniently edit and format content and upload files in Joomla. It is the most commonly installed editor extension across the entire Joomla landscape. It is precisely this enormous distribution that makes the discovered flaw so dangerous.

On 3 June 2026, the manufacturer Widget Factory released a critical emergency patch. The reason: in all JCE versions from 1.0.0 up to and including 2.9.99.4, a particular endpoint – the profile import function (com_jce&task=profiles.import) – allows arbitrary PHP code to be uploaded and executed on the server from the outside and without any login at all. Experts call this an unauthenticated remote code execution (RCE) – in other words, the ability to run someone else's program code on a server remotely without even having to log in.

The result of a successful attack: a so-called web shell – a small piece of malware that lets the attacker control the server remotely. From there, data theft, spam distribution, ransomware, or lateral movement to other systems within the same hosting environment become possible.

The technical background – explained clearly

CVE-2026-48907 is not a single piece of sloppiness but a chain of three independent flaws that together make the attack possible in the first place. The Vulnerability Research team at YesWeHack sums it up aptly:

„CVE-2026-48907 is the result of a chained design weakness in the JCE profile import: missing authorization, insufficient file validation, and disabled upload security. Together they allow unauthenticated attackers to upload and execute arbitrary PHP code via the /tmp directory. No session cookie. No username. No password. Three HTTP requests.“ (YesWeHack, patch analysis of 12 June 2026)

The three flaws in detail:

• Missing authentication: The import endpoint only checked a so-called CSRF token – a security code that is actually meant to protect against forged requests. However, this token could be read off any public page. No genuine login check took place.
• No file extension check: The upload mechanism did not verify what type of file was being uploaded. Even a file named shell.xml.php passed the check unhindered.
• Deliberately disabled security feature: Joomla's own protection function, which normally blocks dangerous file extensions such as .php, was explicitly disabled.

The attack runs in just three steps: the attacker calls up the home page to grab the CSRF token. Then they upload a disguised PHP file as a supposed "profile", which ends up in the publicly accessible /tmp directory. Finally, they simply call up this file via the browser – and the malicious code is executed. No user account, no session, no special configuration required.

Who is affected?

Affected are all Joomla websites using the JCE editor in a version prior to 2.9.99.5. And that is a great many.

Particularly alarming for companies here: Germany leads worldwide Joomla usage. According to TechnologyChecker.io, 17 to 24.5 percent of all recorded Joomla companies are based in Germany – around 11,612 companies. And: 85 percent of Joomla users worldwide are micro-enterprises with up to ten employees – precisely the kind of businesses that rarely have their own IT security department or regular patch cycles.

Phil Taylor of the analytics platform mysites.guru puts the risk in a nutshell:

„JCE runs on more Joomla sites than any other editor extension. When an unauthenticated JCE file-upload flaw meets a long tail of installations that nobody has updated, you get mass, automated, opportunistic compromises.“

That the danger is real is confirmed by several independent bodies. The US security agency CISA added the flaw to its catalogue of Known Exploited Vulnerabilities (KEV) on 16 June 2026 and set US federal agencies a deadline of just three days – one of the shortest patch windows ever set. The Centre for Cybersecurity Belgium (CCB) and SecurityWeek also warned of active exploitation in the wild. Public exploit code is available, and the attacks are running automatically.

How to check whether you are affected

Go through these steps – ideally immediately:

1. Check the JCE version: In the Joomla backend, under Extensions → Manage → Manage, search for "JCE". Alternatively, read off the version number under Components → JCE Editor → Control Panel. Anything before 2.9.99.5 is vulnerable.
2. Check for foreign profiles: Under Components → JCE Editor → Editor Profiles, review all existing profiles. Unknown profiles with automatically generated names, unusual upload permissions, or access granted to public user groups are a clear warning sign.
3. Search for suspicious PHP files: Search upload directories such as /images/, /media/, and /tmp/ for PHP files that do not belong there. On Linux servers, the following command helps:
   find images/ tmp/ media/ -name '*.php' -mtime -90 -ls
4. Analyse server logs: Search the access logs for requests to the affected endpoint. Example:
   grep 'com_jce.*task=profiles.import' /var/log/apache2/access.log
   The earliest hit shows when an attack first occurred.
5. Free security audit: The tool mysites.guru offers a free audit at mysites.guru/free-audit/ that detects foreign JCE profiles and uploaded web shells.
6. File comparison: Compare your JCE files by checksum against a clean reference installation. Unexpected changes may indicate embedded backdoors.

What you need to do now

Important first of all: An update alone is not enough if your site has already been compromised. The patch closes the door to future attacks – but does not remove what an attacker may already have left behind. The manufacturer makes this unmistakably clear:

„The vulnerability is being actively exploited, working exploit code is public, and the attacks are automated – so a site with no public registration is not safe. The update closes the entry point but does not clean up an already compromised site. If you were hit before the update, the update does not remove what the attacker left behind.“ (Widget Factory / JCE manufacturer)

Proceed in this order:

1. Update immediately: Update JCE to version 2.9.99.10 (but at least 2.9.99.5). Update via System → Update → Extensions → JCE → Update. For JCE Pro, first enter your valid subscription key under Components → JCE Editor → Options → Subscription Key.
2. Secure evidence: Before any cleanup, create a full backup of the file system, database, and server logs. This backup serves to preserve evidence – not as a trustworthy recovery source.
3. Check for compromise: Review server logs for accesses to the import endpoint, check all JCE profiles for unknown entries, and scan upload directories for PHP files.
4. Remove foreign profiles and web shells: Delete unknown JCE profiles and remove all files uploaded through them.
5. Rotate credentials: Change all passwords – Joomla admin, database, FTP/SFTP/SSH, hosting panel, API keys, and SMTP. Also on other systems where the same passwords were used.
6. Run a malware scan: Have a full server-side malware scan carried out (many hosts use Imunify360 or similar for this).
7. Harden: Disable PHP execution in upload directories (Apache: .htaccess with php_flag engine off; Nginx: corresponding location block). Set up a WAF rule for the affected endpoint. Restrict the admin area to VPN or office IPs and enable multi-factor authentication (MFA).
8. In case of confirmed compromise: Check GDPR reporting obligations and, when in doubt, consider a complete reinstallation from trusted sources.

Are you running a very old JCE version (2.7.x, 2.8.x, 2.9.x) that cannot be updated to 2.9.99.x? Then the manufacturer provides a free security patch at joomlacontenteditor.net/downloads/editor/security-patch. It closes the flaw but does not add any further hardening. If even that is not possible, you should uninstall JCE completely.

GDPR: Why this is not just a technical problem

For German SMEs, a possible compromise carries a tangible legal dimension. If personal data – for example from contact forms, shops, or member areas – became or could have become accessible through an attack, the requirements of the GDPR apply:

• Reporting obligation (Art. 33 GDPR): Data breaches must be reported to the competent state data protection authority within 72 hours of becoming aware of them. For websites with stored data, such a risk must regularly be assumed.
• Notification of data subjects (Art. 34 GDPR): In the case of high risk – for example the leakage of payment or health data – the affected individuals must also be informed.
• State of the art (Art. 32 GDPR): Failing to apply an available, critical security update can be regarded as a breach of the duty to implement appropriate security measures.
• Documentation obligation (Art. 33(5) GDPR): Even if no report is required, you must document the incident.

Fines under Art. 83 GDPR for inadequate security measures can amount to up to 10 million euros or 2 percent of global annual turnover. The competent authority in each case is the data protection authority of your federal state.

Context: Why history threatens to repeat itself

Sven Kessel of RheinMainTech, who has analysed the flaw in detail for the German-speaking region, warns:

„CVE-2026-48907 shows how quickly an extension can become the entry point for a complete server compromise. A security update closes the known attack path for future attempts. However, it does not necessarily remove profiles that have already been created, uploaded files, or persistence mechanisms installed afterwards.“

A look at the past underlines the urgency: back in 2012, CVE-2012-2902 was a very similar unauthenticated JCE file-upload flaw. It became one of the most widely used Joomla exploits of its time – and websites were still being compromised years after the patch, because countless installations were never updated. It is precisely this scenario that now threatens to repeat itself.

Conclusion

CVE-2026-48907 is as critical as a vulnerability can be: maximum CVSS score of 10.0, no prior knowledge and no login required, publicly available exploit code, and confirmed, automated mass attacks. As the country with the highest Joomla usage worldwide, Germany is particularly exposed – and micro-enterprises without their own IT department are especially at risk.

The course of action is clear: Update JCE to version 2.9.99.10 today, then thoroughly check for signs of a compromise that has already occurred – and, when in doubt, rotate all credentials. An update applied only next week may be too late against automated attacks. Act now.