ywh-jfellus/cve-2026-48907PoC for CVE-2026-48907 - Joomla! JCE extension < 2.9.99.5 unauthenticated RCE
⚠️ This repository is for educational and defensive security purposes only. Test only on systems you own or are explicitly authorized to assess. Do not use this project against third-party systems.
This PoC demonstrates CVE-2026-48907, an unauthenticated RCE vulnerability affecting Joomla Content Editor (JCE) versions up to 2.9.99.4.
It exploits missing authentication and validation in JCE's profile import functionality,
It differs from BIBIL_0DAY's original PoC, as it relies on the fact that JCE's profile import stages the uploaded profile file to tmp/, without authentication nor file format nor content validation. Since default Joomla configuration allows PHP execution from tmp/ folder, this leads to a straightforward RCE path.
Restricting PHP execution or even public access to tmp/ folder easily mitigates this vector.
Joomla users are encouraged to harden their webserver configuration and to update JCE to >=2.9.99.5.
vulnerable/ – docker-compose deploying a Joomla instance using the official Docker image and installs JCE 2.9.99.4 (vulnerable version). Listens on joomla:latest127.0.0.1:9999patched/ – docker-compose deploying a Joomla instance using the official joomla:latest Docker image and installs JCE 2.9.99.5 (patched version). Listens on 127.0.0.1:9999Running
docker compose -f vulnerable/docker-compose.yaml up
python3 poc.py
yields
{"success":true,"message":"","messages":{"info":["0 Profile(s) imported successfully"]},"data":{"redirect":"\/index.php\/component\/jce?view=profiles"}}
>> 3105
[!!!!!] PHP payload was executed ! Server is vulnerable to cve-2026-48907 !
This project is intended to help researchers, defenders, and administrators understand the vulnerability and validate remediation efforts in a controlled environment. The authors are not responsible for any misuse of this material.