Search: CVE-2026-48907

A critical vulnerability (CVE-2026-48907) in the Joomla Content Editor (JCE) extension for Joomla allows unauthenticated users to create new editor profiles. This flaw leads to the upload and execution of arbitrary PHP code, posing a severe risk to affected systems. The vulnerability affects versions from 1.0.0 up to and including 2.9.99.4. Exploitation requires no privileges or user interaction and has been observed in the wild. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS 4.0 base score of 10.0, indicating maximum severity.