The JCE editor in Joomla with a dangerous flaw, updating is not everything
If your site runs on Joomla, there is a good chance you use Joomla Content Editor (JCE), one of the most installed content editors. CERT Polska warns that it has just been found to have a critical flaw, and ready-made code to exploit it is already circulating publicly.
What happened
The vulnerability (CVE-2026-48907) lets an attacker without logging in create a new editor profile and, through it, upload and run their own PHP code. The end result is the same as with other flaws of this type, a full takeover of the site or server.
The most important sentence in the whole advisory: an update patches the hole, but it does not undo the changes an attacker has already made. If someone got in earlier, they stay inside.
Who it affects and how to protect yourself
Vulnerable are all JCE versions up to and including 2.9.99.4. The safe versions are 2.9.99.5 and the latest 2.9.99.6. For older sites that cannot fully update, the vendor released a free mitigation package for versions 2.7.x, 2.8.x and 2.9.x.
Beyond updating, be sure to check whether the site bears signs of a break-in:
- unknown editor profiles in the JCE section (often with a random name, at the top of the list),
- profiles that allow uploading PHP files in the allowed-extensions setting,
- suspicious, unauthorised PHP files in the
images,mediaortmpfolders, - in the server logs, unusual requests to the JCE profile-import function.
That is precisely the difference between "patching" and "cleaning up". We do both: update the editor, review the site for these indicators and remove anything the attacker may have left behind.
Not sure whether your site is safe? Send it to us, we will check it for you, calmly and without technical babble.
Source: CERT Polska advisory 101/2026