Improper Input Validation in Joomla Content Editor by Joomla
CVE-2026-65891

6.5MEDIUM

Key Information:

Vendor

Joomlacontenteditor.net

Status
Joomla Content Editor (jce) Extension For Joomla
Vendor
CVE Published:
29 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-65891?

The Joomla Content Editor (JCE) prior to version 2.20.2 is affected by an improper input validation vulnerability. This flaw permits authenticated users with file management permissions to rename files, even to invalid names, which can lead to the creation of hidden files. Additionally, this flaw may result in unintended overwrite of existing files at the destination path. This vulnerability poses a risk to the integrity and security of files managed by JCE.

Affected Version(s)

Joomla Content Editor (JCE) extension for Joomla 1.0.0-2.9.99.9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-65891
Created by murrez

References

https://www.joomlacontenteditor.net/
product

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mürrez
.