Skip to content
OpenAdvisories
Medium · 6.5 Public exploit CVE-2026-65891 EUVD-2026-50305GHSA-chfv-whhw-v522

Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.9.99.10

Published Jul 29, 2026 · Updated Jul 31, 2026 · Assigned by Joomla

Vendor: joomlacontenteditor.net Product: Joomla Content Editor (JCE) extension for Joomla Category: Web / CMS

Description

Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.20.2 - Improper input validation in the file rename functionality allowed an authenticated user with file management permissions to rename files to otherwise invalid names, resulting in the creation of hidden files. The issue also allowed existing files at the destination path to be unintentionally replaced.

Affected products

VendorProductAffectedFixed
joomlacontenteditor.net Joomla Content Editor (JCE) extension for Joomla 1.0.0-2.9.99.9 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • murrez/CVE-2026-65891 ★ 0 · Aug 10, 2026

    CVE-2026-65891 PoC — Joomla Content Editor file rename vulnerability (auth required, fixed in JCE 2.20.2)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References