# CVE-2026-48907 — JCE (Joomla Content Editor) Improper Access Control Enabling Unauthenticated PHP Code Upload and Remote Code Execution

> A critical (CVSS v4.0 10.0) improper-access-control flaw in the JCE (Joomla Content Editor) extension lets unauthenticated attackers import a malicious editor profile via the com_jce profiles.import endpoint, enabling arbitrary PHP file upload and execution for full website compromise. CISA added it to the KEV catalog on 2026-06-16 on evidence of active, automated mass exploitation.

- **Published:** 2026-06-17T00:00:00Z
- **Last reviewed:** 2026-06-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0830
- **ID:** TL-2026-0830
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48907

## Description

CVE-2026-48907 is an unauthenticated remote code execution vulnerability in the JCE (Joomla Content Editor) extension, one of the most widely deployed editors in the Joomla ecosystem, affecting all versions up to and including 2.9.99.4. The root cause is a chain of three design failures in the JCE profile-import workflow. First, the AJAX endpoint reachable at index.php?option=com_jce&task=profiles.import performs no authorization check (no $user->authorise('core.manage','com_jce') call); it relies solely on a CSRF token, which an unauthenticated client can scrape from the public homepage before submitting the request, effectively making the import workflow anonymous (CWE-862 / CWE-284). Second, the import handler accepts attacker-supplied XML profile documents and writes uploaded content with Joomla's File::makeSafe()/File::upload($src,$dest,false,true) where the final 'true' argument disables Joomla's built-in dangerous-extension blacklist, so files such as foo.xml.php pass validation (CWE-434, CWE-20). Third, default Joomla deployments permit PHP execution from the writable /tmp/, /images/, and /media/ directories where the dropper lands, completing the chain to code execution.

The live attack is typically three HTTP requests: (1) GET / to harvest the CSRF token from homepage markup; (2) POST /index.php?option=com_jce&task=profiles.import carrying a multipart profile_file field whose payload is PHP wrapped as XML; and (3) GET of the dropped /tmp/<name>.xml.php (or a file under /images or /media) to execute the web shell. A second observed variant chains profiles.import with a follow-on POST to index.php?option=com_jce&task=plugin.rpc&plugin=browser&method=upload&id=RCE<rand> to write the payload through the freshly created permissive profile. Rogue profiles created by the campaign carry machine-generated names matching ^J[0-9]{6}$ (e.g. J940401, J938560, J991471) or descriptive labels such as 'Pwned', 'Pwned (2)', and descriptions like 'RCE via JCE'; they are forced to the top of the profile list with a large negative ordering value (e.g. -99999), scoped Area 0 / Types 1,8 (public/anonymous), permit php/phtml/txt uploads, and disable MIME validation (validate_mimetype:0). Deployed web shells include eval(gzinflate(base64_decode(...))) loaders, shell_exec($_POST[...]) command shells, and files bearing the 'Nxploited' marker, staged under /tmp/, /images/, /media/system/js/, and /libraries/joomla/.

The campaign is opportunistic, internet-wide, and automation-driven (observed python-requests and browser User-Agents from a distributed set of source IPs including 107.149.130.5, 92.38.150.143, and 45.153.129.241), consistent with commodity botnet mass-exploitation rather than a single attributed actor. The vendor (Widget Factory / joomlacontenteditor.net) shipped 2.9.99.5 on 2026-06-03 with the authorization fix and an .xml-only extension allowlist, then 2.9.99.6 on 2026-06-06 adding a 512KB upload cap, XXE hardening (libxml_disable_entity_loader on PHP 7.x), and an XML field allowlist; a free backport patch is offered for legacy 2.7.x–2.9.x installs. Because exploitation requires no authentication or user interaction and yields direct code execution, NVD scored it CVSS v4.0 10.0 and CISA's KEV addition (under BOD 26-04) places it in the highest-urgency remediation tier for federal civilian agencies.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Vulnerability Scanning
- T1592 Gather Victim Host Information
- T1583 Acquire Infrastructure
- T1587.004 Exploits
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.011 Lua
- T1505.003 Web Shell
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1070.004 File Deletion
- T1548 Abuse Elevation Control Mechanism
- T1552.001 Credentials In Files
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1491 Defacement

## Sources

- [CISA Adds One Known Exploited Vulnerability to Catalog](https://www.cisa.gov/news-events/alerts/2026/06/16/cisa-adds-one-known-exploited-vulnerability-catalog)
- [NVD — CVE-2026-48907](https://nvd.nist.gov/vuln/detail/CVE-2026-48907)
- [Unauthenticated RCE in the Joomla Content Editor extension](https://www.yeswehack.com/news/rce-joomla-content-editor-extension)
- [JCE security update and a free patch for older sites](https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites)
- [Find and Fix the JCE Profiles Hack](https://mysites.guru/blog/finding-every-site-running-a-vulnerable-jce/)
- [CVE-2026-48907 — Vulnerability-Lookup (CIRCL)](https://vulnerability.circl.lu/vuln/CVE-2026-48907)
- [GitHub Advisory Database — GHSA-c3f5-4g7f-qjqj](https://github.com/advisories/GHSA-c3f5-4g7f-qjqj)
- [Tenable — CVE-2026-48907](https://www.tenable.com/cve/CVE-2026-48907)
- [nuclei-templates issue #16379 — Joomla JCE unauthenticated RCE via profile import](https://github.com/projectdiscovery/nuclei-templates/issues/16379)
- [CISA BOD 26-04: Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0830