CVE-2026-48907 — Widget Factory Joomla Content Editor (JCE) before version 2.9.99.5: unauthenticated profile-import → PHP RCE (CVSS v4 10.0)
CVE-2026-48907 is an improper-access-control flaw (CWE-284) in the JCE extension — one of the most widely installed third-party Joomla editors — that chains three weaknesses in the profile-import workflow: a missing authentication check on index.php?option=com_jce&task=profiles.import, absent file-extension validation, and disabled upload-safety controls (YesWeHack, 2026-06-16). An unauthenticated attacker imports a crafted editor profile that permits .php (or other executable) extensions for the Image Manager / File Browser plugin, then uploads a web shell that lands in images/ by default — yielding OS-level code execution as the web-server user. The vendor states the attacks are fully automated and that a site without a public registration form is not safe; any site that ran a JCE version before 2.9.99.5 should assume compromise and restore from a pre-breach backup after confirming the timeline from web logs (Widget Factory / JCE, 2026-06-03). CISA added it to the KEV catalog on 2026-06-16. Patched in JCE version 2.9.99.5 (2026-06-03), further hardened in 2.9.99.6 (2026-06-06). Detection: unauthenticated POSTs to profiles.import in web logs; unfamiliar auto-named profiles at the top of the JCE profile list with PHP uploads enabled; unexpected PHP files in images/, media/ or tmp/.
CVE Summary Table
Compact view of the actively-exploited / weaponised CVEs across this brief (full context in § 2 above and the § 4 updates).
| CVE | Product | CVSS | EPSS | KEV | Exploited | Patch | Source |
|---|---|---|---|---|---|---|---|
| CVE-2026-48907 | Joomla Content Editor (JCE) before version 2.9.99.5 | 10.0 (v4) | n/a | Yes (06-16) | Yes — automated | version 2.9.99.5 (06-03) | JCE |
| CVE-2026-39808 | Fortinet FortiSandbox — JRPC OS command injection | 9.8 | n/a | No | Yes (06-15) | Apr 2026 (FG-IR-26-100) | Help Net |
| CVE-2026-39813 | Fortinet FortiSandbox — JRPC path traversal / auth bypass | 9.1 | n/a | No | Yes (06-15) | Apr 2026 (FG-IR-26-112) | Help Net |
| CVE-2026-25089 | Fortinet FortiSandbox — web-UI command injection | 9.8 | n/a | No | Probable (faulty AI-built exploit) | 06-09 (FG-IR-26-141) | Security Affairs |
| CVE-2026-0257 | PAN-OS GlobalProtect — cookie auth bypass | 7.8 (v4) | n/a | Yes | Yes — since May 2026 | Vendor hotfixes | PAN PSIRT |
| CVE-2026-50751 | Check Point Security Gateway — IKEv1 auth bypass | 9.3 | n/a | No | PoC public | Hotfix (early June) | Help Net |
The vulnerability is being actively exploited, working exploit code is public, and the attacks are automated, so a site with no public registration is not safe.
The flaw allows attackers to create fake editor profiles without authentication and abuse the profile import functionality to upload and execute arbitrary PHP code on the server.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.