JCE editor for Joomla let anyone upload code: update and check for intrusions

In June 2026, the developer of JCE (Joomla Content Editor), one of the most common editors for Joomla sites, released version 2.9.99.5 on 3 June to fix a critical flaw, tracked as CVE-2026-48907. An attacker with no account could import a new editor profile that allowed uploading executable files, then use it to upload a script and take control of the site.

The developer stated that the flaw was being actively exploited, that working exploit code was public and that attacks were automated. Sites without public registration were not considered safe. The US agency CISA added the flaw to its catalog of exploited vulnerabilities on 16 June 2026.

Who is affected

Joomla sites with JCE versions before 2.9.99.5. The developer recommends 2.9.99.9 for all sites, which needs PHP 7.4 and Joomla 3.9 or later. For older sites that cannot update, a free patch package covers JCE 2.7, 2.8 and 2.9, but it only closes the hole and is meant as a temporary fix. JCE 2.6 is unsupported.

Unlike a server update, your host does not usually update extensions inside your Joomla site. This is the site owner's or developer's job.

How to check your site

• In the Joomla administrator, open System, then Manage, then Extensions, and search for JCE. The version is shown in the list.
• In the JCE Editor Profiles screen, look for profiles you do not recognise, often with random names at the top of the list, or profiles that allow PHP files in the permitted extensions.
• Ask your host or developer to search the access logs for requests containing option=com_jce&task=profiles.import, and to look for PHP files you did not add in the images, media and tmp folders.

What to do now

1. Update JCE to 2.9.99.9 now. If you cannot, apply the developer's patch package after testing on a copy, or uninstall JCE.
2. Updating closes the door but does not remove an intrusion. If you find unknown profiles or files, keep copies, then delete only those profiles and the files uploaded through them.
3. After a compromise, change your Joomla administrator, database and hosting or FTP passwords, and ask your host for a full malware scan.
4. Keep a recent backup outside the server.

Sites updated in June 2026 or later are most likely protected against this flaw, but a site may have been reached before the update, so the checks above are still worth doing. This alert reports what the sources listed below published and is not a guarantee about any specific site.