Security1 hSeptember 30, 2026, 18:00

Joomla extensions hit by two unauthenticated file upload flaws

Two Joomla extensions carry unauthenticated arbitrary file upload vulnerabilities: CVE-2026-48907 in JCE Editor and CVE-2026-48908 in SP Page Builder. Both are rated high, and FortiGuard Labs observed active exploitation of CVE-2026-48908 after public disclosure.

DEV Community

Open source

Joomla extensions hit by two unauthenticated file upload flaws

CVE-2026-48907 affects JCE Editor, CVE-2026-48908 affects SP Page Builder
Vulnerable endpoints: profiles.import and asset.uploadCustomIcon
Uploading a PHP file leads to remote code execution on the server
FortiGuard reports active exploitation of CVE-2026-48908

#Joomla#JCEEditor#SPPageBuilder

Microsoft Teams lets admins block custom file extensions

Security

LightLLM hit by two CVSS 9.8 unauthenticated RCE flaws

Business

Anthropic filing shows two customers drove nearly a quarter of $4.6B revenue

Business

Joomla extensions hit by two unauthenticated file upload flaws

Microsoft Teams lets admins block custom file extensions

LightLLM hit by two CVSS 9.8 unauthenticated RCE flaws

Anthropic filing shows two customers drove nearly a quarter of $4.6B revenue

Microsoft files to develop two-building campus outside Atlanta, Georgia