Skip to main content
mySites.guru
Free Audit
J!Awards 2026mySites.guru is shortlisted for Your Favourite Tool in Your Joomla WorkflowVote by 11 OctoberHow to vote
CVE-2026-65891MediumCVSS 6.5CVE published 29 July 2026Added to mySites.guru 29 July 2026

JCE (com_jce) 2.9.99.6 to 2.9.99.9 - Authenticated Privileged File Rename Creating a Hidden File

JCE (Joomla Content Editor) versions 2.9.99.6 through 2.9.99.9 contain a file rename flaw in the editor filesystem functions. An authenticated user with a JCE profile granting file browser access and the Rename permission could rename a file so that it became a hidden dotfile in the folder being browsed, instead of the rename being rejected as invalid. The root cause is an ordering bug: the destination name was validated before it was sanitised, and the sanitiser strips every character outside letters, marks, numbers, underscore, dot and hyphen, so a destination such as "@@@" passed validation and then reduced to an empty string. The filesystem adapter then appended the source extension to that empty name, producing a hidden file. The same release also stopped a rename silently replacing a file that already existed. Exploitation requires authentication and a privileged, file-manager-enabled profile, so this is materially less severe than the unauthenticated upload flaw fixed in 2.9.99.5 (CVE-2026-48907). Fixed in 2.9.99.10. Interim mitigation per the vendor: disable the Rename option in the settings of each file-related plugin (Image Manager, File Browser and similar) for any profile assigned to untrusted or lower-trust users. Note that 2.9.99.10 also silently hardened the upload path well beyond this one item, expanding the blocked executable extension list, adding Unicode normalisation to defeat filename bypasses, replacing a weak 5 character md5/uniqid random filename suffix with a cryptographically secure 16 character one, and removing the allowroot filesystem option.

Is my site affected?

Affected
JCE from 2.9.99.6 up to but not including 2.9.99.10
Fixed in
2.9.99.10
What to do
Update JCE to 2.9.99.10 or later.
Check whether your sites are affected

How CVE-2026-65891 is scored

The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

6.5 Medium

CVSS 3.1, scored by CISA-ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

How it is reached

AV:N Attack vector
Network. Reachable across the internet
AC:L Attack complexity
Low. Nothing to work around, it just works
PR:L Privileges required
Low. Any logged-in account will do
UI:N User interaction
None. Nobody has to be tricked into anything
S:U Scope
Unchanged. Contained to the extension it is in

What it does

C:N Confidentiality
None. Nothing can be read
I:H Integrity
High. Data and files can be altered at will
A:N Availability
None. The site stays up

Timeline

  1. 29 July 2026CVE-2026-65891 record published by its CNA
  2. 29 July 2026mySites.guru check added for JCE (from 2.9.99.6 up to but not including 2.9.99.10)
  3. 29 July 2026We published: JCE 2.9.99.10 Fixes Another Security Issue

Rule details

Our disclosure post

JCE 2.9.99.10 Fixes Another Security Issue

JCE 2.9.99.10 Fixes Another Security Issue

JCE 2.9.99.10 patches a file rename flaw letting a privileged user create a hidden file in the folder they were browsing. The release hardens more too.

Other vulnerabilities in JCE

Updating for CVE-2026-65891 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

JCE

Latest safe version: 2.9.99.10

References

CVE-2026-65891 questions

Which versions are affected by CVE-2026-65891?
CVE-2026-65891 affects JCE from 2.9.99.6 up to but not including 2.9.99.10. The fix is in 2.9.99.10.
How do I fix CVE-2026-65891?
Update JCE to 2.9.99.10 or later. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
How severe is CVE-2026-65891?
CISA-ADP scores it 6.5 (Medium) under CVSS 3.1. In plain terms: reachable across the internet, any logged-in account will do and nobody has to be tricked into anything.

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

Rules current as of 5 October 2026.