Joomla! Extension 'JCE' < 2.9.99.5 Remote Code Execution

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#

include('compat.inc');

if (description)
{
  script_id(321523);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/20");

  script_cve_id("CVE-2026-48907");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/06/19");

  script_name(english:"Joomla! Extension 'JCE' < 2.9.99.5 Remote Code Execution");

  script_set_attribute(attribute:"synopsis", value:
"The remote Joomla! application has an extension installed that is affected by a remote code execution
vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of the JCE (Joomla Content Editor) extension for the Joomla! application running on the remote host is
prior to 2.9.99.5. It is, therefore, affected by an improper access control vulnerability. The extension allows the
creation of new editor profiles for unauthenticated users, ultimately resulting in the upload and execution of
arbitrary PHP code.

Note that Nessus has not tested for this issue but has instead relied only on the extension's self-reported version
number.");
  # https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3201ef28");
  script_set_attribute(attribute:"see_also", value:"https://extensions.joomla.org/extension/jce/");
  script_set_attribute(attribute:"solution", value:
"Upgrade the JCE (Joomla Content Editor) extension to version 2.9.99.5 or later through the administrative dashboard.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/AU:Y/U:Red");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-48907");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/18");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:joomla:joomla\!");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("joomla_extension_detect.nbin");
  script_require_keys("installed_sw/Joomla!", "www/PHP");
  script_require_ports("Services/www", 80);

  exit(0);
}

include("vcf.inc");
include("vcf_extras.inc");

app_info = vcf::joomla::extension::get_app_info(extension:"jce");
vcf::check_granularity(app_info:app_info, sig_segments:4);

constraints = [
  { "fixed_version" : "2.9.99.5" }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);