CVE-2026-65891CWE-20

CVE-2026-65891

Medium · published July 29, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
25.7
In the wild
Unconfirmed
What it is

Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.20.2 - Improper input validation in the file rename functionality allowed an authenticated user with file management permissions to rename files to otherwise invalid names, resulting in the creation of hidden files. The issue also allowed existing files at the destination path to be unintentionally replaced.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00336 · 25.7th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-07-29T17:19Z
Affected products (2)
ProductVersionsFixed in
widgetfactorylimited/jce< 2.20.22.20.2
widgetfactorylimited/jce< 2.20.22.20.2
References (1)
https://www.joomlacontenteditor.net/ · [email protected]
EPSS history
Timeline
  • 29 JUL 12:37Z
    Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.9.99.10
    cvelistv5