CVE-2026-48907 — JCE (Joomla Content Editor) Improper Access Control Enabling Unauthenticated PHP Code Upload and Remote Code Execution — Threadlinqs Intelligence
As of 2026-06-17, CVE-2026-48907 — JCE (Joomla Content Editor) Improper Access Control Enabling Unauthenticated PHP Code Upload and Remote Code Execution is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-0830 · Severity: CRITICAL · CVSS: 10 · Status: ACTIVE · Category: VULNERABILITY
A critical (CVSS v4.0 10.0) improper-access-control flaw in the JCE (Joomla Content Editor) extension lets unauthenticated attackers import a malicious editor profile via the com_jce profiles.import
CVE-2026-48907 is an unauthenticated remote code execution vulnerability in the JCE (Joomla Content Editor) extension, one of the most widely deployed editors in the Joomla ecosystem, affecting all versions up to and including 2.9.99.4. The root cause is a chain of three design failures in the JCE profile-import workflow. First, the AJAX endpoint reachable at index.php?option=com_jce&task=profiles.import performs no authorization check (no $user->authorise('core.manage','com_jce') call); it relies solely on a CSRF token, which an unauthenticated client can scrape from the public homepage before submitting the request, effectively making the import workflow anonymous (CWE-862 / CWE-284). Second, the import handler accepts attacker-supplied XML profile documents and writes uploaded content with Joomla's File::makeSafe()/File::upload($src,$dest,false,true) where the final 'true' argument disables Joomla's built-in dangerous-extension blacklist, so files such as foo.xml.php pass validation (CWE-434, CWE-20). Third, default Joomla deployments permit PHP execution from the writable /tmp/, /images/, and /media/ directories where the dropper lands, completing the chain to code execution.
The live attack is typically three HTTP requests: (1) GET / to harvest the CSRF token from homepage markup; (2) POST /index.php?option=com_jce&task=profiles.import carrying a multipart profile_file field whose payload is PHP wrapped as XML; and (3) GET of the dropped /tmp/<name>.xml.php (or a file under /images or /media) to execute the web shell. A second observed variant chains profiles.import with a follow-on POST to index.php?option=com_jce&task=plugin.rpc&plugin=browser&method=upload&id=RCE<rand> to write the payload through the freshly created permissive profile. Rogue profiles created by the campaign carry machine-generated names matching ^J[0-9]{6}$ (e.g. J940401, J938560, J991471) or descriptive labels such as 'Pwned', 'Pwned (2)', and descriptions like 'RCE via JCE'; they are forced to the top of the profile list with a large negative ordering value (e.g. -99999), scoped Area 0 / Types 1,8 (public/anonymous), permit php/phtml/txt uploads, and disable MIME validation (validate_mimetype:0). Deployed web shells include eval(gzinflate(base64_decode(...))) loaders, shell_exec($_POST[...]) command shells, and files bearing the 'Nxploited' marker, staged under /tmp/, /images/, /media/system/js/, and /libraries/joomla/.
The campaign is opportunistic, internet-wide, and automation-driven (observed python-requests and browser User-Agents from a distributed set of source IPs including 107.149.130.5, 92.38.150.143, and 45.153.129.241), consistent with commodity botnet mass-exploitation rather than a single attributed actor. The vendor (Widget Factory / joomlacontenteditor.net) shipped 2.9.99.5 on 2026-06-03 with the authorization fix and an .xml-only extension allowlist, then 2.9.99.6 on 2026-06-06 adding a 512KB upload cap, XXE hardening (libxml_disable_entity_loader on PHP 7.x), and an XML field allowlist; a free backport patch is offered for legacy 2.7.x–2.9.x installs. Because exploitation requires no authentication or user interaction and yields direct code execution, NVD scored it CVSS v4.0 10.0 and CISA's KEV addition (under BOD 26-04) places it in the highest-urgency remediation tier for federal civilian agencies.
Weaknesses (CWE)
CWE-284, CWE-862, CWE-434, CWE-20, CWE-611
Target sectors: any-organization-running-joomla, small-and-medium-business, government, education, media-and-publishing, hosting-providers
Target regions: Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-48907, T1595, T1595.002, T1592, T1583, T1587.004, T1190, T1059, T1059.011, T1505.003, T1098
