---
id: 4150
title: "CVE-2026-48907: Unauthenticated RCE in the Joomla Content Editor extension"
cve: CVE-2026-48907
cvss: 9.8
severity: critical
source_domain: yeswehack.com
source_url: "https://www.yeswehack.com/news/rce-joomla-content-editor-extension"
published_at: "2026-06-12 13:16"
tags: ["active-exploitation", "rce", "public-poc", "access-control", "vulnerability", "patch-analysis", "webshell", "joomla", "cve-2026-48907"]
phying_url: "https://phying.com/item/4150"
lang: en
---

# CVE-2026-48907: Unauthenticated RCE in the Joomla Content Editor extension

## Summary

YesWeHack's analysis of CVE-2026-48907, a CVSS 10.0 unauthenticated RCE in the Joomla Content Editor: profile import abuse drops a PHP webshell; fixed in 2.9.99.5 with hardening in 2.9.99.6.

## Intelligence Metadata

- **Sources:** yeswehack.com
- **CVE:** CVE-2026-48907
- **CVSS:** 9.8
- **Published:** 2026-06-12 13:16
- **Original:** https://www.yeswehack.com/news/rce-joomla-content-editor-extension
- **Phying News:** https://phying.com/item/4150