CVE-2026-65891

Analyzed Analyzed - Analysis Complete

Hidden File Creation and Unintended Overwrite in Joomla Content Editor

Publication date: 2026-07-29

Last updated on: 2026-08-05

Assigner: Joomla! Project

Description

Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.20.2 - Improper input validation in the file rename functionality allowed an authenticated user with file management permissions to rename files to otherwise invalid names, resulting in the creation of hidden files. The issue also allowed existing files at the destination path to be unintentionally replaced.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-05

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-65891

Affected Vendors & Products

Vendor	Product	Version / Range
widgetfactorylimited	jce	to 2.20.2 (exc)
widgetfactorylimited	jce	to 2.20.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability affects Joomla Content Editor (JCE) versions before 2.20.2. It involves improper input validation in the file rename function, allowing authenticated users with file management permissions to create hidden files or overwrite existing files by renaming them to invalid names.

Detection Guidance

Check for hidden files in Joomla directories, especially those created or modified by the JCE extension. Review file rename operations in server logs for suspicious activity. Look for files with unusual names or extensions in web-accessible folders.

Impact Analysis

An attacker with file management permissions could create hidden files or overwrite critical files, potentially leading to data loss, unauthorized access, or system compromise. This could disrupt website functionality or expose sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized file creation or modification, potentially violating data integrity and confidentiality requirements under GDPR or HIPAA. Organizations may face compliance violations if sensitive data is exposed or altered.

Mitigation Strategies

Update the Joomla Content Editor (JCE) to version 2.20.2 or later. Remove any unauthorized hidden files found in the system. Restrict file management permissions to trusted users only.

Hi! I’m here to help you understand CVE-2026-65891. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70