## https://sploitus.com/exploit?id=7F2A4B72-DD31-5492-B340-9C9BF558759E
# CVE-2026-65891 — Joomla JCE Rename PoC
Proof-of-concept scanner for **CVE-2026-65891** in the [Joomla Content Editor (JCE)](https://www.joomlacontenteditor.net/) extension.
Improper input validation in the JCE file manager **rename** function allows an authenticated user with file-management permissions to:
- create **hidden files** (dot-prefixed names, e.g. `.shell.php`)
- **silently overwrite** existing files at the destination path
> **Authorized testing only.** Use on systems you own or have explicit permission to test.
## Vulnerability summary
| Field | Value |
|-------|--------|
| **CVE** | [CVE-2026-65891](https://nvd.nist.gov/vuln/detail/CVE-2026-65891) |
| **Product** | JCE (com_jce) — Widget Factory Limited |
| **Affected** | JCE **< 2.20.2** (through 2.20.1 / 2.9.99.9) |
| **Fixed** | **JCE 2.20.2+** (2026-07-29) |
| **CVSS 3.1** | **6.5 Medium** |
| **CWE** | CWE-20 — Improper Input Validation |
| **Auth** | Required — JCE upload + rename permissions |
| **KEV** | No |
This is **not** unauthenticated RCE. Do not confuse with [CVE-2026-48907](https://nvd.nist.gov/vuln/detail/CVE-2026-48907) (JCE profile import, unauth).
## Root cause
JCE `browser` / `imgmanager` rename handlers accepted destination filenames that should be rejected:
- names starting with `.` (hidden on POSIX)
- renames that replace an existing file without confirmation
Fixed in **2.20.2**: extension validation on rename/copy/move and no silent overwrite.
## What this PoC does
### `check` (no credentials)
- Detect Joomla + JCE installation
- Read JCE version from `jce.xml` / assets
- Flag versions **< 2.20.2**
### `probe` / `exploit` (credentials required)
1. Login via `/administrator/` (or `--frontend-login`)
2. Obtain Joomla CSRF token
3. Upload a marker `.txt` via `plugin.rpc` (`browser` plugin)
4. Rename to `.cve65891_.txt` (hidden)
5. `GET /images/.cve65891_*.txt` — if marker is readable → **EXPLOITED**
## Installation
```bash
git clone https://github.com/YOUR_USER/CVE-2026-65891.git
cd CVE-2026-65891
pip install -r requirements.txt
```
**Requirements:** Python 3.10+
## Usage
```bash
# Version / fingerprint scan (bulk, no auth)
python poc_cve_2026_65891.py -f targets.txt -m check -j 30 -o version_hits.txt
# Single target — full check
python poc_cve_2026_65891.py -u https://joomla.example -m check -v
# Authenticated rename test
python poc_cve_2026_65891.py -u https://joomla.example -m probe \
--user editor --pass 'YourPassword' -v
# Session cookie instead of password
python poc_cve_2026_65891.py -u https://joomla.example -m probe \
--cookie-file cookie.txt -v
```
### Options
| Flag | Description |
|------|-------------|
| `-u`, `--url` | Single Joomla base URL |
| `-f`, `--file` | Target list (one URL per line) |
| `-m`, `--mode` | `check` · `probe` · `exploit` · `full` (default: `full`) |
| `-j`, `--threads` | Parallel workers (default: 15) |
| `-t`, `--timeout` | HTTP timeout seconds (default: 25) |
| `-o`, `--output` | Write **VULNERABLE** / **EXPLOITED** hits only |
| `--user` | Joomla username |
| `--pass` | Joomla password |
| `--cookie-file` | Raw `Cookie:` header file (skip login) |
| `--upload-dir` | JCE upload directory (default: `images`) |
| `--frontend-login` | Login via frontend instead of administrator |
| `-v`, `--verbose` | Debug output |
### Modes
| Mode | Auth | Description |
|------|------|-------------|
| `check` | No | Joomla + JCE + version |
| `probe` | Yes | Upload + hidden rename + verify |
| `exploit` | Yes | Same as probe |
| `full` | Yes* | check then probe (*probe needs auth) |
## Output example
```
EXPLOITED https://joomla.example joomla=True jce=True ver=2.20.1 auth=YES upload=YES rename=YES hidden=YES url=https://joomla.example/images/.cve65891_a1b2c3d4.txt
VULNERABLE https://site.example joomla=True jce=True ver=2.9.99.9 rename=YES err=rename_ok_but_hidden_not_readable
SUSPECT https://old.example joomla=True jce=True ver=2.20.1 err=need_auth_--user_--pass_or_--cookie-file
```
Only **VULNERABLE** and **EXPLOITED** lines are written to `-o`.
## Prerequisites for probe/exploit
The test account must have a JCE editor profile with:
- **File browser / Image manager** access
- **Upload** permission
- **Rename** permission
Typically: Editor, Manager, or Administrator — not a plain registered user.
## Mitigation
1. Upgrade JCE to **2.20.2** or later
`Extensions → Manage → Update` or download from [joomlacontenteditor.net](https://www.joomlacontenteditor.net/)
2. Until patched: disable **Rename** in JCE profile settings for non-trusted user groups (Image Manager, File Browser).
## Detection
Look for authenticated requests to:
```
POST /index.php?option=com_jce&task=plugin.rpc&plugin=browser
```
With `method=rename` / `renameItem` and destination names starting with `.`.
Unexpected hidden files under JCE upload paths (`/images/`, `/media/`).
## Legal disclaimer
This tool is for **security research, education, and authorized penetration testing** only. Unauthorized access to computer systems is illegal. The author assumes no liability for misuse.
## References
- [NVD — CVE-2026-65891](https://nvd.nist.gov/vuln/detail/CVE-2026-65891)
- [JCE — joomlacontenteditor.net](https://www.joomlacontenteditor.net/)
- [OpenCVE](https://app.opencve.io/cve/CVE-2026-65891)
## License
MIT — see [LICENSE](LICENSE).