Affected versions: ≥ 2.9.99.6 and < 2.9.99.10
Full advisory: our disclosure post
CVE-2026-65891MediumPublished 29 July 2026
JCE (com_jce) 2.9.99.6 to 2.9.99.9 - Authenticated Privileged File Rename Creating a Hidden File
JCE (Joomla Content Editor) versions 2.9.99.6 through 2.9.99.9 contain a file rename flaw in the editor filesystem functions. An authenticated user with a JCE profile granting file browser access and the Rename permission could rename a file so that it became a hidden dotfile in the folder being browsed, instead of the rename being rejected as invalid. The root cause is an ordering bug: the destination name was validated before it was sanitised, and the sanitiser strips every character outside letters, marks, numbers, underscore, dot and hyphen, so a destination such as "@@@" passed validation and then reduced to an empty string. The filesystem adapter then appended the source extension to that empty name, producing a hidden file. The same release also stopped a rename silently replacing a file that already existed. Exploitation requires authentication and a privileged, file-manager-enabled profile, so this is materially less severe than the unauthenticated upload flaw fixed in 2.9.99.5 (CVE-2026-48907). Fixed in 2.9.99.10. Interim mitigation per the vendor: disable the Rename option in the settings of each file-related plugin (Image Manager, File Browser and similar) for any profile assigned to untrusted or lower-trust users. Note that 2.9.99.10 also silently hardened the upload path well beyond this one item, expanding the blocked executable extension list, adding Unicode normalisation to defeat filename bypasses, replacing a weak 5 character md5/uniqid random filename suffix with a cryptographically secure 16 character one, and removing the allowroot filesystem option.
Affected versions: ≥ 2.9.99.6 and < 2.9.99.10
Official record: cve.org · NVD
Related vulnerabilities
Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.
Affected extensions and versions
Our disclosure post
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 25 August 2026.