Security
JCE 2.9.99.10 fixes privileged file rename flaw
JCE 2.9.99.10 fixes a file-handling vulnerability that could let a privileged, authenticated user hide a file in the directory they were viewing.
The JCE developer released 2.9.99.10 on 29 July 2026. According to research published by mySites.guru, the affected versions are 2.9.99.6 through 2.9.99.9. The issue requires a valid login, a JCE profile with file-browser access, and the Rename permission.
This is an authenticated privilege-related file handling flaw. It could turn a filename into a hidden file, but does not provide code execution. The report does not identify active exploitation of this issue, and no CVE had been assigned as of the release date. The update also prevents renaming from silently replacing an existing file.
Administrators should update JCE to 2.9.99.10 through the Joomla administrator interface. Until that is possible, the developer advises disabling Rename in file-related plugins for profiles assigned to untrusted or lower-trust users. This workaround addresses only the rename issue.
- Sites below
2.9.99.6should be treated as needing urgent attention for the separate unauthenticated upload flaw fixed in2.9.99.5, identified asCVE-2026-48907. - The release also includes additional file-validation and upload-hardening changes not fully detailed in the changelog.
Originally reported by mySites.guru.