CVE-2026-48907 — Joomla Content Editor (JCE) Unauthenticated RCE

CVE-2026-48907 is a maximum-severity (CVSS v4 10.0) unauthenticated remote code execution flaw in the Joomla Content Editor (JCE) extension, present in all versions up to and including 2.9.99.4. The root cause is a chained design failure in JCE's profile import workflow: a missing authorization check lets an unauthenticated attacker create a fake editor profile, insufficient file validation lets that profile re-enable uploads of .php and .txt files, and disabled upload safety controls then permit a webshell to be uploaded and executed.

Attackers drop a PHP webshell into world-writable web directories such as /images/, /media/, or /tmp/, yielding a persistent, unauthenticated backdoor on the Linux web server (Apache/nginx + PHP-FPM). From there the typical objective is command execution, ingress tool transfer, and lateral movement. CISA added CVE-2026-48907 to the Known Exploited Vulnerabilities catalog on 2026-06-16, citing active, automated exploitation, and ordered FCEB agencies to patch by Friday. Fixed in JCE 2.9.99.5 (early June 2026), with additional hardening in 2.9.99.6.

The highest-value defensive angle is behavioral, not signature-based: a web-server process (httpd / apache2 / nginx / php-fpm) is not supposed to spawn an interactive shell or write a new .php file into an upload directory. Those two telemetry events are the spine of this hunt and survive payload/IP rotation that automated exploitation churns through.

Defender priority: Patch JCE to ≥ 2.9.99.5 immediately. In parallel, hunt for httpd/apache2/nginx/php-fpm → sh/bash/python/perl process lineage and for new .php files written under web-writable directories. A single confirmed hit on either is a probable live webshell — treat as active intrusion.

Web-hunter note: Atomic IOCs (specific webshell hashes, C2 IPs) are not consistently published because exploitation is automated and payloads/infrastructure rotate. The pack therefore leads with behavioral detection and treats published file/IP indicators as perishable hunt/enrich values rather than durable blocks.

Hypotheses (ordered by fidelity)

1. H1 (high): A web-server process (httpd/apache2/nginx/php-fpm) spawned an interactive shell or scripting interpreter (sh/bash/dash/python/perl) → webshell command execution. Lowest FP, highest fidelity.
2. H2 (high): A new .php file was written into a web-writable, non-code directory (/images/, /media/, /tmp/) by a web-server-owned process → dropped webshell.
3. H3 (medium): The web-server process tree spawned recon/network utilities (whoami/id/uname/curl/wget) shortly after a shell, indicating hands-on-keyboard or scripted post-exploitation.
4. H4 (medium): A web-server process made outbound connections to new/rare external IPs (ingress tool transfer or reverse shell), i.e. server-initiated egress that is atypical for a content site.
5. H5 (medium): Local web/access logs show unauthenticated POSTs to JCE profile-import / file-upload endpoints (com_jce controller, profile import, upload tasks) — the exploitation request itself.
6. H6 (low): A web-server-owned ELF or interpreter executed from a writable upload/temp path (second-stage tooling staged via the webshell).

Attack chain

Exploitation is automated and payloads/infrastructure rotate; few durable atomic IOCs are published. The values below are behavioral and contextual. Replace REPLACE_WITH_* placeholders with indicators confirmed in your own telemetry before promoting to a block.

Checks that do not require Falcon process telemetry — run these directly on the host or against shipped logs:

• JCE version inventory: In Joomla admin → Extensions → Manage, confirm JCE is ≥ 2.9.99.5 (ideally 2.9.99.6). Any host ≤ 2.9.99.4 is presumed exposed.
• Webshell sweep: On each web root, list .php files under non-code upload dirs and sort by mtime:
  find /var/www -path '*/images/*' -o -path '*/media/*' -name '*.php' -newermt '2026-06-01' -printf '%TY-%Tm-%Td %p\n'
• Access-log review: grep web/access logs for POSTs to com_jce profile-import / upload tasks, especially from single source IPs hitting many sites or with non-browser user agents.
• Profile-config diff: Review JCE editor profiles for unexpected/unknown profiles or profiles that allow .php/.txt uploads.
• Auth correlation: Webshell activity is unauthenticated — there will be no corresponding admin login. Absence of an auth event before a config change is itself suspicious.

Promotion candidates from the hunt queries above (Linux platform, Process Create rule type):

Q2 (PHP file write) is best deployed as a scheduled-search detection rather than a Process-Create IOA, since it keys on file telemetry, not process creation.

One-click copy blocks for ingestion. Atomic indicators are perishable for this automated campaign — use placeholders until you confirm values in your own telemetry.

type,value,action,severity,expiration,description,tags
sha256,REPLACE_WITH_WEBSHELL_SHA256,detect,critical,2026-12-18,JCE CVE-2026-48907 webshell,campaign:JoomlaJCE
ipv4,REPLACE_WITH_SCANNER_OR_C2_IP,detect,high,2026-09-18,JCE exploit source or C2,campaign:JoomlaJCE
domain,REPLACE_WITH_C2_DOMAIN,detect,high,2026-09-18,JCE second-stage C2,campaign:JoomlaJCE

parent_proc IN (httpd, apache2, nginx, php-fpm)
  AND child_proc IN (sh, bash, dash, python, perl)   # webshell exec
file_write: *.php INTO (/images/, /media/, /tmp/, /files/)  # webshell drop
proc_exec FROM (/tmp/, /var/tmp/, /dev/shm/, /images/)      # staged tooling
http_post: option=com_jce & (profile import | upload)      # exploit request

CVE-2026-48907 — Joomla Content Editor (JCE) unauth RCE
Affected: JCE <= 2.9.99.4   Fixed: 2.9.99.5 (hardening in 2.9.99.6)
Mechanism: profile-import authz bypass + .php/.txt upload re-enable
Webshell drop dirs: /images/  /media/  /tmp/  /files/
Server: Linux, Apache/nginx + PHP-FPM

# Find JCE version across web roots (XML manifest)
grep -rl --include=jce.xml -m1 'version' /var/www 2>/dev/null \
  | xargs -r grep -H '<version>'
# Webshell sweep: new .php in upload dirs since campaign start
find /var/www \( -path '*/images/*' -o -path '*/media/*' \) \
  -name '*.php' -newermt '2026-06-01' -printf '%TY-%Tm-%Td %p\n'

A · Block PHP execution in upload dirs (Apache)

Drop into the vhost / .htaccess of each web-writable directory:

# /var/www/<site>/images/.htaccess  (repeat for media, tmp, files)
<FilesMatch "\.(php|phtml|php[0-9]|phar)$">
    Require all denied
</FilesMatch>
php_admin_flag engine off

B · Block PHP execution in upload dirs (nginx)

# in the server { } block, before the generic php location
location ~* ^/(images|media|tmp|files)/.*\.(php|phtml|php[0-9]|phar)$ {
    deny all;
    return 403;
}

C · Harden writable mount + web-user privileges (Linux)

# mount the upload/tmp volume noexec,nosuid,nodev (then remount)
# /etc/fstab:  /var/www/<site>/tmp  ext4  defaults,noexec,nosuid,nodev  0 0
mount -o remount /var/www/<site>/tmp
# make the Joomla code tree read-only to the PHP-FPM user (www-data)
chown -R root:www-data /var/www/<site>
find /var/www/<site> -type d -exec chmod 750 {} \;
find /var/www/<site> -type f -exec chmod 640 {} \;
systemctl restart php-fpm

D · Patch verification

# confirm JCE manifest reports a fixed version (>= 2.9.99.5)
grep -rH '<version>' /var/www --include=jce.xml 2>/dev/null

Validation: Coverage of the webshell-execution spine (Q1/Q2) is strong and low-FP. The exploitation request (Q5) is only covered where web/access logs are forwarded to NGSIEM — confirm log shipping or accept the partial gap. Post-foothold lateral movement is intentionally out of scope here and is covered by standard EDR detections. Validate Q2/Q6 path regexes and Q5 HTTP field names against your tenant before deploying.