Improper input validation in Joomlacontenteditor.net Joomla Content Editor (Jce) Extension For
CVE-2026-65891
Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.20.2 - Improper input validation in the file rename functionality allowed an authenticated user with file management permissions to rename files to otherwise invalid names, resulting in the creation of hidden files. The issue also allowed existing files at the destination path to be unintentionally replaced.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.003 (17.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Joomlacontenteditor.net Joomla Content Editor (Jce) Extension For — versions 1.0.0-2.9.99.9
- Widgetfactorylimited Jce
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@joomla.org (Product, product)
Frequently asked questions
- What is CVE-2026-65891?
- CVE-2026-65891 is a medium-severity vulnerability in Joomlacontenteditor.net Joomla Content Editor (Jce) Extension For, classified under Improper Input Validation. CVSS score: 6.5/10. Published 2026-07-29.
- How severe is CVE-2026-65891?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2026-65891 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.