CVE-2026-65891 — Joomla JCE Rename PoC

Proof-of-concept scanner for CVE-2026-65891 in the Joomla Content Editor (JCE) extension.

Improper input validation in the JCE file manager rename function allows an authenticated user with file-management permissions to:

• create hidden files (dot-prefixed names, e.g. .shell.php)
• silently overwrite existing files at the destination path

Authorized testing only. Use on systems you own or have explicit permission to test.

Vulnerability summary

This is not unauthenticated RCE. Do not confuse with CVE-2026-48907 (JCE profile import, unauth).

Root cause

JCE browser / imgmanager rename handlers accepted destination filenames that should be rejected:

• names starting with . (hidden on POSIX)
• renames that replace an existing file without confirmation

Fixed in 2.20.2: extension validation on rename/copy/move and no silent overwrite.

What this PoC does

check (no credentials)

• Detect Joomla + JCE installation
• Read JCE version from jce.xml / assets
• Flag versions < 2.20.2

probe / exploit (credentials required)

1. Login via /administrator/ (or --frontend-login)
2. Obtain Joomla CSRF token
3. Upload a marker .txt via plugin.rpc (browser plugin)
4. Rename to .cve65891_<random>.txt (hidden)
5. GET /images/.cve65891_*.txt — if marker is readable → EXPLOITED

Installation

git clone https://github.com/YOUR_USER/CVE-2026-65891.git
cd CVE-2026-65891
pip install -r requirements.txt

Requirements: Python 3.10+

Usage

# Version / fingerprint scan (bulk, no auth)
python poc_cve_2026_65891.py -f targets.txt -m check -j 30 -o version_hits.txt

# Single target — full check
python poc_cve_2026_65891.py -u https://joomla.example -m check -v

# Authenticated rename test
python poc_cve_2026_65891.py -u https://joomla.example -m probe \
  --user editor --pass 'YourPassword' -v

# Session cookie instead of password
python poc_cve_2026_65891.py -u https://joomla.example -m probe \
  --cookie-file cookie.txt -v

Options

Modes

Output example

EXPLOITED  https://joomla.example  joomla=True  jce=True  ver=2.20.1  auth=YES  upload=YES  rename=YES  hidden=YES  url=https://joomla.example/images/.cve65891_a1b2c3d4.txt
VULNERABLE https://site.example     joomla=True  jce=True  ver=2.9.99.9  rename=YES  err=rename_ok_but_hidden_not_readable
SUSPECT    https://old.example     joomla=True  jce=True  ver=2.20.1  err=need_auth_--user_--pass_or_--cookie-file

Only VULNERABLE and EXPLOITED lines are written to -o.

Prerequisites for probe/exploit

The test account must have a JCE editor profile with:

• File browser / Image manager access
• Upload permission
• Rename permission

Typically: Editor, Manager, or Administrator — not a plain registered user.

Mitigation

1. Upgrade JCE to 2.20.2 or later
   Extensions → Manage → Update or download from joomlacontenteditor.net

2. Until patched: disable Rename in JCE profile settings for non-trusted user groups (Image Manager, File Browser).

Detection

Look for authenticated requests to:

POST /index.php?option=com_jce&task=plugin.rpc&plugin=browser

With method=rename / renameItem and destination names starting with ..

Unexpected hidden files under JCE upload paths (/images/, /media/).

Legal disclaimer

This tool is for security research, education, and authorized penetration testing only. Unauthorized access to computer systems is illegal. The author assumes no liability for misuse.

References

• NVD — CVE-2026-65891
• JCE — joomlacontenteditor.net
• OpenCVE

License

MIT — see LICENSE.