HTProtect.org
Independent information site on Joomla security vulnerabilities
EN
HTProtect HTProtect JOOMLA SECURITY
New htprotect.app - Centralized Joomla Site Management for Multiple Websites
htprotect.org Vulnerabilities & update guides
New htprotect.app - Centralized Joomla Site Management for Multiple Websites
Security vulnerability

JCE (JoomlaContentEditor) – critical file upload, actively exploited

Critical Actively exploitedCVE: No specific CVE assigned
Act now
Update JCE to 2.9.99.5 (better 2.9.99.6) immediately – the flaw is being actively exploited.
Download the secure version Go to the update steps

Secure version: JCE 2.9.99.5 – better 2.9.99.6 · JCE Core free · Pro with account

At a glance

Affected extension
JCE Editor – Free & Pro, component com_jce
Vendor
JoomlaContentEditor
Type of flaw
Insufficient access control → unauthenticated upload of arbitrary files (via editor profiles)
Affected versions
All versions before 2.9.99.5 (Free and Pro)
Secure version
JCE 2.9.99.5 – better 2.9.99.6   Download
Severity
Critical · actively exploited
CVE
No specific CVE assigned
Joomla compatibility
Joomla 3 / 4 / 5 / 6
Status / published
Fix: 3 June 2026 · follow-up 2.9.99.6: 8 June 2026

What is this about?

JCE (JoomlaContentEditor) is one of the most widely used editors for Joomla. The vendor describes the cause as insufficient access control: unauthenticated users could upload editor profiles and through them place arbitrary files on the server.

Affected are all versions before 2.9.99.5 – both JCE Free and JCE Pro – and indeed regardless of whether public registration is enabled. The fix appeared on 3 June 2026 as 2.9.99.5; after a full security audit, version 2.9.99.6 followed on 8 June 2026.

The flaw is actively exploited: attackers install web shells through it. Since no login is required, sites without open registration are at risk too. Editor profiles with random names or a "Public" assignment are particularly suspicious. (Historically, JCE was already the target of large-scale attacks in 2011/2012 – CVE-2012-2902.)

Am I affected? – How to check

  1. Open the back end

    Log in to the Joomla administrator.

  2. Check the JCE version

    Open Components›JCE Editor. The version number is shown there.

  3. Assess the version

    If the version is below 2.9.99.5, action is urgently needed.

  4. Review editor profiles

    Check the JCE editor profiles for unknown entries with random names or a Public assignment.

How to fix it

Before any update: back up
Back up your files and database before updating – so you can roll back if anything goes wrong (e.g. via Akeeba Backup or your host).
  1. Open the Update center

    Go to System›Update›Extensions and click Check for updates.

  2. Update JCE

    Select the JCE entry and click Update (target version 2.9.99.5 / 2.9.99.6).

  3. Verify the version

    Check under Components›JCE Editor that the new version is active.

Manual installation (alternative)
Alternatively, download the package from joomlacontenteditor.net and install it via Extensions›Manage›Install. Expired JCE Pro subscription? You can either switch to the free JCE Core or renew the subscription – all that matters is reaching at least 2.9.99.5.
Download the secure version

Official source: JCE Core free · Pro with account. Make sure you have at least JCE 2.9.99.5 – better 2.9.99.6.

Has the site already been attacked?

Actively exploited – check the site
Because the flaw is already abused for web shells, after updating you should specifically look for planted files and suspicious editor profiles. An update closes the hole but does not remove backdoors already placed – when in doubt, have it professionally cleaned and change passwords.

Need help with the clean-up? Find qualified specialists in the Joomla Service Providers Directory.

Sources & further reading

The official information from the respective vendor always takes precedence. This page neutrally summarises publicly available information.

Related vulnerabilities

Other extensions with comparable weaknesses. Check whether any of them is installed on your site.

iCagendaCritical
Event calendarLearn more
Helix3 FrameworkCriticalactively exploited
JoomShaperLearn more
Astroid FrameworkCriticalactively exploited
TemPlazaLearn more
Back to all vulnerabilities
Supporters

Supporters of this site

htprotect.org is a free, vendor-independent information service. It is supported by:

Host & community
FC-Hosting

Joomla host from Germany with active community support – discovered the first attack on the JCE vulnerability.

fc-hosting.de
Initiator & operator
Website-Bereinigung.de

Specialised in cleaning, maintaining and securing Joomla and WordPress websites.

website-bereinigung.de

Support this project

You run a hosting or Joomla service and would like to support htprotect.org – and be listed here as a supporter? Every contribution helps to warn and protect those affected faster.

Prefer to give privately, without a listing? A little something for the tip jar is just as welcome.

Support HTProtect now
Bauschild & Service

Manufactures and installs construction-site signs, hoardings and façade solutions – including design and 3D visualisation.

bauschildundservice.de
IT Specialista

Professional IT support from Czechia – Windows management, domain administration and web hosting.

defendersoft.cz
onlineweg.de

Travel portal from Germany – package holidays, hotels and flights online, with personal travel-agency advice.

onlineweg.de
Criadero

Creative agency from Brandenburg – web design, print media, photography and 360° panoramas from a single source.

criadero.de
Jahn EDV-Dienst GmbH

IT service provider from Wächtersbach – Joomla websites, PC service, hardware and software.

jahnedv.de
IsariConsult

Information-security consulting from Berlin – security analyses, risk management and ISO 27001 for SMEs.

isari-consult.de