CVE-2026-48907 — JCE (Joomla Content Editor) Improper Access Control Enabling Unauthenticated PHP Code Upload and Remote Code Execution

CVE-2026-48907 (TL-2026-0830), also tracked as JCE Profiles Hack, is a critical-severity software vulnerability scored CVSS 10, first published 2026-06-17. It has no confirmed attribution, affects Widget Factory (joomlacontenteditor.net) JCE (Joomla Content Editor), references 1 CVE (CVE-2026-48907), maps to 21 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-0830

Threat ID
TL-2026-0830
Also known as
JCE Profiles Hack, Joomla Content Editor profile import RCE
Severity
CRITICAL
CVSS
10 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-17
Last reviewed
2026-06-17
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
any-organization-running-joomla, small-and-medium-business, government, education, media-and-publishing, hosting-providers
Target regions
Global
Detection rules
9
Indicators of compromise
18

Malware and tooling in CVE-2026-48907

Malware and tooling: Nxploited

A critical (CVSS v4.0 10.0) improper-access-control flaw in the JCE (Joomla Content Editor) extension lets unauthenticated attackers import a malicious editor profile via the com_jce profiles.import endpoint, enabling arbitrary PHP file upload and execution for full website compromise. CISA added it to the KEV catalog on 2026-06-16 on evidence of active, automated mass exploitation.

How CVE-2026-48907 works

CVE-2026-48907 is an unauthenticated remote code execution vulnerability in the JCE (Joomla Content Editor) extension, one of the most widely deployed editors in the Joomla ecosystem, affecting all versions up to and including 2.9.99.4. The root cause is a chain of three design failures in the JCE profile-import workflow. First, the AJAX endpoint reachable at index.php?option=com_jce&task=profiles.import performs no authorization check (no $user->authorise('core.manage','com_jce') call); it relies solely on a CSRF token, which an unauthenticated client can scrape from the public homepage before submitting the request, effectively making the import workflow anonymous (CWE-862 / CWE-284). Second, the import handler accepts attacker-supplied XML profile documents and writes uploaded content with Joomla's File::makeSafe()/File::upload($src,$dest,false,true) where the final 'true' argument disables Joomla's built-in dangerous-extension blacklist, so files such as foo.xml.php pass validation (CWE-434, CWE-20). Third, default Joomla deployments permit PHP execution from the writable /tmp/, /images/, and /media/ directories where the dropper lands, completing the chain to code execution.

The live attack is typically three HTTP requests: (1) GET / to harvest the CSRF token from homepage markup; (2) POST /index.php?option=com_jce&task=profiles.import carrying a multipart profile_file field whose payload is PHP wrapped as XML; and (3) GET of the dropped /tmp/<name>.xml.php (or a file under /images or /media) to execute the web shell. A second observed variant chains profiles.import with a follow-on POST to index.php?option=com_jce&task=plugin.rpc&plugin=browser&method=upload&id=RCE<rand> to write the payload through the freshly created permissive profile. Rogue profiles created by the campaign carry machine-generated names matching ^J[0-9]{6}$ (e.g. J940401, J938560, J991471) or descriptive labels such as 'Pwned', 'Pwned (2)', and descriptions like 'RCE via JCE'; they are forced to the top of the profile list with a large negative ordering value (e.g. -99999), scoped Area 0 / Types 1,8 (public/anonymous), permit php/phtml/txt uploads, and disable MIME validation (validate_mimetype:0). Deployed web shells include eval(gzinflate(base64_decode(...))) loaders, shell_exec($_POST[...]) command shells, and files bearing the 'Nxploited' marker, staged under /tmp/, /images/, /media/system/js/, and /libraries/joomla/.

The campaign is opportunistic, internet-wide, and automation-driven (observed python-requests and browser User-Agents from a distributed set of source IPs including 107.149.130.5, 92.38.150.143, and 45.153.129.241), consistent with commodity botnet mass-exploitation rather than a single attributed actor. The vendor (Widget Factory / joomlacontenteditor.net) shipped 2.9.99.5 on 2026-06-03 with the authorization fix and an .xml-only extension allowlist, then 2.9.99.6 on 2026-06-06 adding a 512KB upload cap, XXE hardening (libxml_disable_entity_loader on PHP 7.x), and an XML field allowlist; a free backport patch is offered for legacy 2.7.x–2.9.x installs. Because exploitation requires no authentication or user interaction and yields direct code execution, NVD scored it CVSS v4.0 10.0 and CISA's KEV addition (under BOD 26-04) places it in the highest-urgency remediation tier for federal civilian agencies.

MITRE ATT&CK techniques used in TL-2026-0830

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion

Execution

T1059 Command and Scripting Interpreter; T1059.011 Lua

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer

Discovery

T1083 File and Directory Discovery

Persistence

T1098 Account Manipulation; T1505.003 Web Shell

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1491 Defacement

privilege-escalation

T1548 Abuse Elevation Control Mechanism

Credential Access

T1552.001 Credentials In Files

Resource Development

T1583 Acquire Infrastructure; T1587.004 Exploits

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning; T1595.002 Vulnerability Scanning

Affected products and versions in CVE-2026-48907

  • Widget Factory (joomlacontenteditor.net) — JCE (Joomla Content Editor) extension for Joomla
    Vulnerable versions: <= 2.9.99.4; 2.7.x; 2.8.x; 2.9.x prior to 2.9.99.5
    Fixed in: 2.9.99.5; 2.9.99.6

Remediation for CVE-2026-48907

Patches

  • JCE 2.9.99.5 (2026-06-03) — authorization check + .xml-only extension allowlist.
  • JCE 2.9.99.6 (2026-06-06, recommended) — 512KB upload cap, XXE hardening, XML field allowlist.
  • Vendor free security backport for Joomla/PHP-constrained 2.7.x-2.9.x installations.

Immediate actions

  • Update JCE to 2.9.99.6 (minimum 2.9.99.5) immediately; legacy 2.7.x-2.9.x sites that cannot upgrade should apply the vendor free backport patch.
  • Hunt for rogue editor profiles: SELECT id, name FROM <prefix>_wf_profiles WHERE name REGEXP '^J[0-9]{6}$' OR name LIKE 'Pwned%'; delete confirmed-malicious profiles after preserving them for forensics.
  • Search for unauthorized PHP/web-shell files in /tmp/, /images/, /media/, /media/system/js/ and /libraries/joomla/ (e.g. *.xml.php, files containing 'Nxploited', eval(gzinflate(base64_decode or shell_exec($_POST).
  • Grep web access logs for POST requests to task=profiles.import and task=plugin.rpc&plugin=browser&method=upload to scope breach timing.

Workarounds

  • Block the com_jce profiles.import and plugin.rpc browser upload endpoints at the perimeter/WAF until patched.
  • Remove web-server write+execute overlap on /tmp, /images, /media.

Longer-term hardening

  • Disable PHP execution in /tmp, /images and /media via web-server config (deny .php handler in upload/writable directories).
  • Deploy a WAF rule blocking unauthenticated requests to com_jce profiles.import and plugin.rpc upload tasks.
  • Reset all administrative, database, and hosting credentials on any site showing indicators of compromise and run full server-side malware scans.
  • Subscribe to CISA KEV and BOD 26-04 monitoring to triage exposed internet-facing CMS assets rapidly.

CVEs associated with CVE-2026-48907

CVE-2026-48907

Weaknesses (CWE) in CVE-2026-48907

CWE-284, CWE-862, CWE-434, CWE-20, CWE-611

Timeline of CVE-2026-48907

  • Vendor (Widget Factory) releases JCE 2.9.99.5 with the missing authorization fix and an .xml-only extension allowlist.
  • CVE-2026-48907 published to NVD; YesWeHack publishes technical writeup detailing the three-request profile-import RCE chain.
  • Vendor releases recommended JCE 2.9.99.6 adding 512KB upload cap, XXE hardening, and XML field allowlist.
  • ProjectDiscovery nuclei-templates issue #16379 opened to fingerprint the unauthenticated profile-import RCE.
  • GitHub Advisory Database (GHSA-c3f5-4g7f-qjqj) and other trackers publish CVE-2026-48907 details.
  • Researchers document active mass exploitation: rogue J######/Pwned profiles, /tmp web shells, and attacker source IPs.
  • NVD last-modified date; CVSS v4.0 base score confirmed at 10.0 (CRITICAL).
  • CISA adds CVE-2026-48907 to the Known Exploited Vulnerabilities catalog on evidence of active exploitation.

Sources cited for CVE-2026-48907

Threats related to CVE-2026-48907

Detection coverage for TL-2026-0830

As of 2026-06-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0830 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats