Exploit for CVE-2026-48907

## https://sploitus.com/exploit?id=290D6A34-87D4-5C44-9D9F-381353970DEF
# CVE-2026-48907 Educational PoC

> ⚠️ This repository is for educational and defensive security purposes only. Test only on systems you own or are explicitly authorized to assess. Do not use this project against third-party systems.

This PoC demonstrates [CVE-2026-48907](https://nvd.nist.gov/vuln/detail/CVE-2026-48907), an unauthenticated RCE vulnerability affecting Joomla Content Editor (JCE) versions up to 2.9.99.4. 

It exploits missing authentication and validation in JCE's profile import functionality, 

It differs from [BIBIL_0DAY's original PoC](https://github.com//webshellseo8//CVE-2026-48907-Unauthenticated-RCE-in-JCE), as it relies on the fact that JCE's profile import stages the uplaoded profile file to `tmp/`, without authentication nor file format nor content validation. Since default Joomla configuration allows PHP execution from `tmp/` folder, this leads to a straightforward RCE path. 

Restricting PHP execution or even public access to `tmp/` folder easily mitigates this vector. 
**Joomla users are encouraged to hardened their webserver configuration and to update JCE to `>=2.9.99.5`**.

## Labs

* `vulnerable/` – docker-compose deploying a Joomla instance using the official `joomla:latest` Docker image and installs JCE 2.9.99.4 (vulnerable version). Listens on `127.0.0.1:9999`
* `patched/` – docker-compose deploying a Joomla instance using the official `joomla:latest` Docker image and installs JCE 2.9.99.5 (patched version). Listens on `127.0.0.1:9999`

Running

```bash
docker compose -f vulnerable/docker-compose.yaml up
python3 poc.py
```

yields

```
{"success":true,"message":"","messages":{"info":["0 Profile(s) imported successfully"]},"data":{"redirect":"\/index.php\/component\/jce?view=profiles"}}

>> 3105

[!!!!!] PHP payload was executed ! Server is vulnerable to  cve-2026-48907 !
```


## Disclaimer

This project is intended to help researchers, defenders, and administrators understand the vulnerability and validate remediation efforts in a controlled environment. The authors are not responsible for any misuse of this material.