EUVD-2026-50305
GHSA-chfv-whhw-v522
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
PR:L reflects required authentication with explicit file management permissions; I:H from potential file overwrite of sensitive server files; C:N and A:N as description confirms no confidentiality or availability impact.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
Lifecycle Timeline
3DescriptionCVE.org
Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.20.2 - Improper input validation in the file rename functionality allowed an authenticated user with file management permissions to rename files to otherwise invalid names, resulting in the creation of hidden files. The issue also allowed existing files at the destination path to be unintentionally replaced.
AnalysisAI
File integrity compromise in Joomla Content Editor (JCE) before version 2.20.2 allows authenticated users holding file management permissions to rename files to invalid names - enabling creation of hidden dot-prefixed files (e.g., .htaccess, .env) and silent overwriting of existing files at the destination path. The root cause (CWE-20) is missing validation of the user-supplied target filename in the JCE rename API endpoint. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.14% (4th percentile) indicates very low opportunistic exploitation probability, though the ability to silently replace sensitive server-side files such as .htaccess adds practical gravity that the CVSS integrity score alone does not fully convey.
Technical ContextAI
CWE-20 (Improper Input Validation) is the root cause: the JCE file manager component exposes a file rename function accessible to authenticated Joomla users who have been granted file management permissions. The server fails to validate the target filename against an allowlist of legal characters and patterns, permitting names beginning with a dot (hidden files on POSIX/Linux systems) or names that resolve to paths already occupied by existing files. On Apache/Linux stacks - the dominant Joomla deployment environment - this means an attacker can overwrite files such as .htaccess (Apache directory-level configuration), potentially enabling PHP execution in upload directories or inserting malicious rewrite rules. No CPE strings were supplied in the input data, but the affected component is the JCE extension for Joomla CMS, versions prior to 2.20.2, operating within any Joomla installation on any supported stack. The 'Information Disclosure' tag present in the source data appears misclassified; the CVSS vector and description both indicate an integrity impact with no confidentiality component.
RemediationAI
The primary fix is upgrading Joomla Content Editor (JCE) to version 2.20.2 or later; this is the patched release identified in the CVE description. Administrators should obtain the update from the official vendor site at https://www.joomlacontenteditor.net/ and verify the changelog confirms the rename validation fix. As a compensating control prior to patching, administrators should audit which Joomla user accounts hold JCE file management permissions and revoke that role from any account not operationally required to manage files - this directly removes the PR:L attack surface without requiring a code change. If the JCE file manager component is not actively needed by content editors, disabling it entirely is a viable interim control; this eliminates the attack vector at the cost of file-browsing functionality. No additional workarounds are documented in the available references. Note that permission audits should also cover any Joomla super-administrator or manager groups that inherit file management rights transitively.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today