CVE-2026-48907

CVE-2026-48907 — Joomla JCE extension unauthenticated RCE is a vulnerability in the Joomla Content Editor (JCE) that allows unauthenticated users to create editor profiles and upload PHP payloads, enabling remote code execution. Technical details across documents show an unrestricted file upload ...

CVE-2015-7339

CVE-2015-7339 affects JCE Joomla Component (versions 2.5.0–2.5.2). The flaw lets an attacker upload arbitrary files by crafting an image file with a .php extension to the /com_jce/editor/libraries/classes/browser.php script, enabling potential code execution or server compromise as implied by arb...

CVE-2026-65891

Affected software: Joomla Extension - joomlacontenteditor.net, Joomla Content Editor (JCE) prior to 2.20.2. Root cause: improper input validation in the file rename functionality, allowing an authenticated user with file-management permissions to rename files to invalid names, resulting in hidden...