JCE (com_jce) below 2.9.99.6 - Unauthenticated Arbitrary File Upload (RCE) and Directory Traversal
JCE versions before 2.9.99.6 are affected by critical security issues, including an unauthenticated arbitrary file upload via editor profile upload that can lead to remote code execution and full server compromise, an authenticated authorisation bypass where a user could reach an editor profile they were not assigned to, and a directory traversal that listed folder contents outside the configured directory. Both JCE Core and JCE Pro are affected on Joomla 3, 4, 5 and 6. Update to 2.9.99.6 or later via the Joomla Update Manager.
Affected versions: ≥ 2.7.0 and < 2.9.99.6
Full advisory: our disclosure post
JCE (com_jce) 2.5.0 to 2.5.2 - Unauthenticated Arbitrary File Upload (RCE) (CVE-2015-7339)
JCE 2.5.0 to 2.5.2 allow arbitrary file upload: a .php file submitted as an image reaches /com_jce/editor/libraries/classes/browser.php and can then be executed, giving remote code execution. CVSS 8.8 (High). Update to a current JCE release. This range sits below the 2.7.0 floor of the main JCE rule, which was set to avoid matching companion plugins that report element com_jce at 1.x, so it needs its own bounded row.
Affected versions: ≥ 2.5.0 and ≤ 2.5.2
Full advisory: nvd.nist.gov
JCE (com_jce) 2.9.99.6 to 2.9.99.9 - Authenticated Privileged File Rename Creating a Hidden File
JCE (Joomla Content Editor) versions 2.9.99.6 through 2.9.99.9 contain a file rename flaw in the editor filesystem functions. An authenticated user with a JCE profile granting file browser access and the Rename permission could rename a file so that it became a hidden dotfile in the folder being browsed, instead of the rename being rejected as invalid. The root cause is an ordering bug: the destination name was validated before it was sanitised, and the sanitiser strips every character outside letters, marks, numbers, underscore, dot and hyphen, so a destination such as "@@@" passed validation and then reduced to an empty string. The filesystem adapter then appended the source extension to that empty name, producing a hidden file. The same release also stopped a rename silently replacing a file that already existed. Exploitation requires authentication and a privileged, file-manager-enabled profile, so this is materially less severe than the unauthenticated upload flaw fixed in 2.9.99.5 (CVE-2026-48907). Fixed in 2.9.99.10. Interim mitigation per the vendor: disable the Rename option in the settings of each file-related plugin (Image Manager, File Browser and similar) for any profile assigned to untrusted or lower-trust users. Note that 2.9.99.10 also silently hardened the upload path well beyond this one item, expanding the blocked executable extension list, adding Unicode normalisation to defeat filename bypasses, replacing a weak 5 character md5/uniqid random filename suffix with a cryptographically secure 16 character one, and removing the allowroot filesystem option.
Affected versions: ≥ 2.9.99.6 and < 2.9.99.10
Full advisory: our disclosure post
Running JCE on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
CVE identifiers: CVE-2026-48907, CVE-2015-7339, CVE-2026-65891. Rules current as of 13 September 2026.
