Widgetfactorylimited
Monthly
File integrity compromise in Joomla Content Editor (JCE) before version 2.20.2 allows authenticated users holding file management permissions to rename files to invalid names - enabling creation of hidden dot-prefixed files (e.g., .htaccess, .env) and silent overwriting of existing files at the destination path. The root cause (CWE-20) is missing validation of the user-supplied target filename in the JCE rename API endpoint. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.14% (4th percentile) indicates very low opportunistic exploitation probability, though the ability to silently replace sensitive server-side files such as .htaccess adds practical gravity that the CVSS integrity score alone does not fully convey.
File integrity compromise in Joomla Content Editor (JCE) before version 2.20.2 allows authenticated users holding file management permissions to rename files to invalid names - enabling creation of hidden dot-prefixed files (e.g., .htaccess, .env) and silent overwriting of existing files at the destination path. The root cause (CWE-20) is missing validation of the user-supplied target filename in the JCE rename API endpoint. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.14% (4th percentile) indicates very low opportunistic exploitation probability, though the ability to silently replace sensitive server-side files such as .htaccess adds practical gravity that the CVSS integrity score alone does not fully convey.