## https://sploitus.com/exploit?id=D957F9E4-9C77-51C8-ABF6-D8CDEFA692D0
# Joomla JCE CVE-2026-48907 โ PoC Validation, Webshell Artifacts and SOC Detection
> Defensive validation report and SOC-oriented detection notes for **CVE-2026-48907** affecting Joomla Content Editor (JCE) versions up to **2.9.99.4**.
## Repository purpose
This repository documents a controlled laboratory validation of **CVE-2026-48907** in Joomla JCE and focuses on practical detection engineering for SOC teams.
The goal is not to provide exploitation guidance. The goal is to show which telemetry sources were useful during validation, which artifacts were created, and how defenders can detect and respond to this activity.
## Reports
- [English PDF report](reports/Joomla_JCE_CVE-2026-48907_POC_EN.pdf)
- [Polish PDF report](reports/Joomla_JCE_CVE-2026-48907_POC_PL.pdf)
- [English DOCX report](reports/Joomla_JCE_CVE-2026-48907_POC_EN.docx)
- [Polish DOCX report](reports/Joomla_JCE_CVE-2026-48907_POC_PL.docx)
## Summary
| Area | Finding |
|---|---|
| Vulnerability | CVE-2026-48907 in Joomla Content Editor (JCE); unauthenticated profile creation/import workflow that may lead to PHP upload and code execution. |
| Tested version | JCE **2.9.99.4**. The Joomla administrator panel showed an available update to **2.9.99.7**. |
| Lab result | Public PoC validation confirmed RCE and created a PHP webshell in Joomla `/tmp` as `jce*.xml.php`. Commands were executed as `www-data`. |
| Most valuable telemetry | Apache `access.log`, Apache/PHP `error.log`, auditd `execve` telemetry and filesystem artifacts in `joomla_html/tmp`. |
| Joomla logs | Useful as supporting context, but insufficient on their own. Joomla application logs did not reconstruct the full chain: exploit โ webshell โ command execution. |
| SOC priority | Critical for internet-facing Joomla instances or Joomla instances reachable from less trusted internal networks. |
## Public references
- Public PoC repository: [JoomlaSniper](https://github.com/ynsmroztas/JoomlaSniper)
- CVE Record: [CVE-2026-48907](https://vulners.com/cve/CVE-2026-48907)
- NVD: [CVE-2026-48907](https://nvd.nist.gov/vuln/detail/CVE-2026-48907)
- CISA KEV Catalog: [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
## Lab environment
| Parameter | Value |
|---|---|
| Application URL | `http://172.20.10.3:9999` |
| Joomla container | `joomla-jce-lab`, image `joomla:5-apache` |
| Database container | `joomla-jce-db`, image `mariadb:11` |
| Port mapping | `0.0.0.0:9999 -> 80/tcp` |
| Apache | Apache/2.4.67 (Debian) |
| PHP | PHP 8.3.31 |
| MariaDB | 11.8.8-MariaDB |
| Joomla | Joomla 5.4.6 Stable |
| JCE | 2.9.99.4 |
| Test source | Windows 11, IP `172.20.10.2` |
| Logging | Apache access/error logs, Joomla logs, auditd, Docker logs, filesystem artifacts |
## Evidence screenshots
### Joomla lab site
### Installed vulnerable JCE version
### Joomla shows an available JCE update
### PoC validation result in the lab
### Interactive shell and command execution as www-data
### File artifacts in Joomla tmp directory
## Key defensive observation
A key operational finding is that **Joomla application logs were not enough**.
During the lab test, Joomla logs recorded application-level context such as a `joomlafailure` event, but they did not show the full exploitation chain. The useful chain was visible mainly in:
1. Apache `access.log`
2. Apache/PHP `error.log`
3. auditd `execve` records
4. filesystem artifacts in `joomla_html/tmp`
For SOC monitoring, Joomla logs should be treated as supporting telemetry, not as the primary detection source for this vulnerability.
## Observed attack chain
High-level chain observed during the controlled test:
```text
JCE version discovery
โ
POST to Joomla JCE component
โ
PHP webshell written to Joomla /tmp
โ
HTTP request to /tmp/jce*.xml.php
โ
Command execution through webshell
โ
auditd confirms /usr/bin/dash and commands executed as www-data
```
## Observed HTTP sequence
The clearest evidence was present in Apache `access.log`:
```text
GET /plugins/editors/jce/jce.xml
GET /
POST /index.php?option=com_jce
GET /tmp/jceolxtshs3.xml.php
GET /plugins/editors/jce/jce.xml
POST /index.php?option=com_jce
GET /tmp/jce624jdcfx.xml.php
GET /tmp/jce624jdcfx.xml.php?c=id%20%26%26%20hostname%20%26%26%20pwd
GET /tmp/jce624jdcfx.xml.php?c=whoami
GET /tmp/jce624jdcfx.xml.php?c=hostname
GET /tmp/jce624jdcfx.xml.php?c=id
GET /tmp/jce624jdcfx.xml.php?c=pwd
```
## Apache/PHP error log indicators
The Apache/PHP error log contained valuable parser-related traces:
```text
simplexml_load_string()
administrator/components/com_jce/helpers/profiles.php
RXST
RXEND
```
The `RXST` and `RXEND` markers were particularly useful indicators for this specific PoC family because they appeared in the payload handling path.
## Joomla log limitation
Joomla logs confirmed application logging was active, but they did not reconstruct exploitation:
```text
#Software: Joomla! 5.4.6 Stable [ Kutegemea ] 26-May-2026 16:00 GMT
#Fields: datetime priority clientip category message
2026-06-18T20:37:57+00:00 INFO 172.20.10.2 joomlafailure Username and password do not match or you do not have an account yet.
```
This means that collecting only Joomla logs may miss the most important evidence of CVE-2026-48907 exploitation.
## Filesystem artifacts
The test created PHP webshell files in Joomla `tmp`:
```text
/var/www/html/tmp/jce624jdcfx.xml.php
/var/www/html/tmp/jceolxtshs3.xml.php
```
Host-side paths in the lab:
```text
/home/user/joomla-jce-lab/joomla_html/tmp/jce624jdcfx.xml.php
/home/user/joomla-jce-lab/joomla_html/tmp/jceolxtshs3.xml.php
```
Observed SHA256 hashes:
```text
b6fa303daef8aa8cb39566c73d2cb4a458efb2b1fba48052dd039d45c3beb0aa jce624jdcfx.xml.php
f8bcc802ab56b845c968ed6727228f200f8f4bcd332b8ce82c6980d93ac228fd jceolxtshs3.xml.php
```
Hash-based detection should be treated as low-resilience because file names and payloads may vary. Path, extension, ownership and behavioral correlation are more useful.
## auditd evidence
auditd confirmed that the web server user executed commands from the Joomla `tmp` directory:
```text
CWD=/var/www/html/tmp uid=www-data comm=sh exe=/usr/bin/dash
CWD=/var/www/html/tmp uid=www-data comm=id exe=/usr/bin/id
CWD=/var/www/html/tmp uid=www-data comm=hostname exe=/usr/bin/hostname
CWD=/var/www/html/tmp uid=www-data comm=whoami exe=/usr/bin/whoami
```
This is the strongest confirmation that the activity was not only scanning, but actual remote code execution.
## Detection logic
The strongest detection is correlation-based:
```text
GET /plugins/editors/jce/jce.xml
followed by
POST /index.php?option=com_jce
followed by
GET /tmp/jce*.xml.php
followed by
GET /tmp/jce*.xml.php?c=
and/or
auditd: www-data executes /usr/bin/dash from /var/www/html/tmp
```
## Detection priority
| Severity | Condition | SOC action |
|---|---|---|
| Low | `GET /plugins/editors/jce/jce.xml` from an unusual source | Treat as reconnaissance and correlate with later requests. |
| Medium | `POST /index.php?option=com_jce` without an administrator referer or from an unknown IP | Alert and review subsequent `/tmp` requests. |
| High | `POST com_jce` followed by `GET /tmp/*.php` or `/tmp/*.xml.php` | Verify filesystem artifacts and PHP error logs immediately. |
| Critical | `GET /tmp/jce*.xml.php?c=` or auditd showing `www-data` launching shell/system commands | Treat as confirmed RCE/webshell, isolate or restrict the host and preserve evidence. |
## Indicators and hunting patterns
### HTTP patterns
```text
/plugins/editors/jce/jce.xml
/index.php?option=com_jce
/tmp/jce[a-z0-9]{8}\.xml\.php
/tmp/.*\.(php|phtml|phar)(\?| )
cs-uri-query contains "c="
```
### Filesystem patterns
```text
joomla_html/tmp/jce*.xml.php
/var/www/html/tmp/jce*.xml.php
RXST
RXEND
shell_exec
system
passthru
exec
$_GET['c']
```
## Example triage commands
Use these only on systems you own or are authorized to investigate.
```bash
grep -RniE "com_jce|profiles\.import|task=profiles|/tmp/.*\.php|RXST|RXEND" apache_logs joomla_html/administrator/logs 2>/dev/null
```
```bash
find ./joomla_html/tmp ./joomla_html/images ./joomla_html/media \
-type f \( -iname "*.php" -o -iname "*.phtml" -o -iname "*.phar" -o -iname "*.xml.php" \) -ls
```
```bash
sudo ausearch -k wwwdata_exec -i | grep -E "uid=www-data|comm=sh|/usr/bin/dash|/var/www/html/tmp|whoami|hostname| id |pwd"
```
## Sigma rules
Separate Sigma rule files are available in [`rules/sigma`](rules/sigma/):
- [`joomla_jce_webshell_tmp_access.yml`](rules/sigma/joomla_jce_webshell_tmp_access.yml)
- [`joomla_jce_component_exploit_attempt.yml`](rules/sigma/joomla_jce_component_exploit_attempt.yml)
- [`web_user_shell_from_joomla_tmp_auditd.yml`](rules/sigma/web_user_shell_from_joomla_tmp_auditd.yml)
## Recommended response
| Step | Action | Goal |
|---|---|---|
| 1 | Check whether the instance runs JCE
php_admin_flag engine off
Options -ExecCGI
RemoveHandler .php .phtml .phar
Require all denied
php_admin_flag engine off
Options -ExecCGI
RemoveHandler .php .phtml .phar
Require all denied
```
## MITRE ATT&CK mapping
| Technique | Name | Rationale |
|---|---|---|
| T1190 | Exploit Public-Facing Application | HTTP exploitation of the Joomla/JCE endpoint without authentication. |
| T1505.003 | Server Software Component: Web Shell | PHP webshell created as `/tmp/jce*.xml.php`. |
| T1059.004 | Command and Scripting Interpreter: Unix Shell | `/usr/bin/dash` executed by `www-data`. |
| T1033 | System Owner/User Discovery | `whoami` and `id` executed through the webshell. |
| T1082 | System Information Discovery | `hostname` executed through the webshell. |
| T1083 | File and Directory Discovery | `pwd` and activity in `/var/www/html/tmp`. |
## Risk assessment
The lab confirmed practical exploitation against JCE 2.9.99.4. Authentication to Joomla was not required in the observed flow, and the public PoC automated version detection and webshell creation.
For real environments, the risk is high to critical when Joomla is internet-facing or reachable from less trusted internal networks. A successful attack may leave a persistent webshell, so patching without artifact inspection is not sufficient after suspected exposure.
## Disclaimer
This repository is intended for defensive research, SOC detection engineering and vulnerability management. It does not contain exploit code. Any testing must be performed only in systems you own or are explicitly authorized to assess.