Affected versions: ≥ 2.7.0 and < 2.9.99.6
Full advisory: our disclosure post
CVE-2026-48907CriticalPublished 8 June 2026
JCE (com_jce) below 2.9.99.6 - Unauthenticated Arbitrary File Upload (RCE) and Directory Traversal
JCE versions before 2.9.99.6 are affected by critical security issues, including an unauthenticated arbitrary file upload via editor profile upload that can lead to remote code execution and full server compromise, an authenticated authorisation bypass where a user could reach an editor profile they were not assigned to, and a directory traversal that listed folder contents outside the configured directory. Both JCE Core and JCE Pro are affected on Joomla 3, 4, 5 and 6. Update to 2.9.99.6 or later via the Joomla Update Manager.
Affected versions: ≥ 2.7.0 and < 2.9.99.6
Official record: cve.org · NVD
Related vulnerabilities
Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.
Affected extensions and versions
Our disclosure post
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 25 August 2026.