Affected and fixed releases
CVE-2026-48907 affects Joomla JCE / JCE Pro versions before 2.9.99.5. The access-control flaw could permit unauthorized profile import and PHP execution. JCE 2.9.99.5 fixed the reported flaw; subsequent releases introduced additional hardening. Use a currently supported release compatible with your Joomla installation.
This is an extension vulnerability. Upgrading Joomla core alone does not guarantee that JCE has been patched.
What an authorized site owner should check
- From Joomla administrator's extension inventory, verify whether JCE or JCE Pro is installed and record its exact version. Check the vendor's official update guidance.
- Preserve a restorable backup and server logs. Inspect unexpected editor profiles and administrator accounts; look for unfamiliar PHP files or changes in upload directories, without opening or executing them.
- Apply a vendor-approved JCE security release with a compatible Joomla/PHP environment. Test administrator editing, media uploads and published pages after the update.
- If suspicious activity is identified, preserve evidence, restrict access where necessary, and review persistence and credential exposure. Patching alone does not remove an existing backdoor.
Limitations of a public check
VirusTotal may not reveal JCE or its version in publicly exposed HTML. If the scanner does not identify it, that is an unknown result—not evidence that the site is unaffected. Internal extension inventory is the reliable next step.
Primary sources and patch references
Verify the latest release and vendor-specific backports before taking action. This guide records information available as of 26 October 2026.
Related security guides
Need a second opinion?
Start with a free public website check or describe the concern. Do not send credentials, raw customer data or full private logs. Any technical work beyond the free enquiry requires an agreed scope.