CVE-2026-65891

MEDIUM

Joomla Content Editor < 2.20.2 - Authenticated Hidden File Creation

Title source: manual

Description

Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.20.2 - Improper input validation in the file rename functionality allowed an authenticated user with file management permissions to rename files to otherwise invalid names, resulting in the creation of hidden files. The issue also allowed existing files at the destination path to be unintentionally replaced.

References (1)

Core 1

Core References

Product product

https://www.joomlacontenteditor.net/

Scores

CVSS v3 6.5

EPSS 0.0014

EPSS Percentile 3.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-20

Status published

Products (1)

joomlacontenteditor.net/Joomla Content Editor (JCE) extension for Joomla 1.0.0-2.9.99.9

Published Jul 29, 2026

Tracked Since Jul 29, 2026