{"id":182238,"date":"2026-06-19T08:48:03","date_gmt":"2026-06-19T06:48:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ispravlenie-kriticheskoj-uyazvimosti-v-jce-dopolnenii-dlya-cms-joomla"},"modified":"2026-06-19T08:48:03","modified_gmt":"2026-06-19T06:48:03","slug":"ispravlenie-kriticheskoj-uyazvimosti-v-jce-dopolnenii-dlya-cms-joomla","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/ispravlenie-kriticheskoj-uyazvimosti-v-jce-dopolnenii-dlya-cms-joomla","title":{"rendered":"Correzione di una vulnerabilit\u00e0 critica in JCE, un componente per CMS Joomla","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

In JCE (Joomla Content Editor), uno dei componenti pi\u00f9 storici e popolari nell'ecosistema Joomla, \u00e8 stata risolta una vulnerabilit\u00e0 critica (CVE-2026-48907) che consente di importare il proprio profilo senza autenticazione. Un attaccante pu\u00f2 sfruttare questa vulnerabilit\u00e0 per caricare un profilo che disabilita il controllo dei tipi MIME e permette il caricamento di script PHP sul server. \u00c8 stata segnalata l'utilizzazione di questa vulnerabilit\u00e0 da parte di malintenzionati per installare web shell, fornendo accesso remoto al sistema.<\/p>\n

La vulnerabilit\u00e0 \u00e8 stata corretta nella versione JCE 2.9.99.5, seguita dal rilascio dell'aggiornamento 2.9.99.6 per un rafforzamento della sicurezza. La vulnerabilit\u00e0 colpisce tutte le versioni di JCE (da Joomla 3 a Joomla 6). Dopo aver installato l'aggiornamento, \u00e8 fondamentale assicurarsi che il sistema non sia stato compromesso e che non ci siano backdoor installate dagli attaccanti. <\/p>\n

Puoi controllare la presenza di un profilo fasullo, che di solito ha un nome generato automaticamente privo di significato, nell'interfaccia dell'amministratore nella sezione \u00abComponenti\u00bb \u2014 \u00abEditor JCE\u00bb \u2014 \u00abProfili dell'editor\u00bb. \u00c8 inoltre importante assicurarsi che non ci sia autorizzazione per il caricamento di file PHP nella voce \u00abEstensioni di file consentite\u00bb e verificare i log per richieste all'url di importazione dei profili (index.php?option=com_jce&task=profiles.import). Anche la comparsa di file .htaccess esterni e di file con nomi tipici di CMS WordPress, piuttosto che Joomla, come wp-config.php e wp-cron.php, pu\u00f2 indicare una compromissione.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 JCE (Joomla Content Editor), \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0441\u0442\u0430\u0440\u0435\u0439\u0448\u0438\u0445 \u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0435\u0439\u0448\u0438\u0445 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0439 \u0432 \u044d\u043a\u043e\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Joomla, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-48907), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u043c\u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0444\u0438\u043b\u044c \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0444\u0438\u043b\u044f, \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0433\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 MIME-\u0442\u0438\u043f\u043e\u0432 \u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 PHP-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440. \u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 webshell, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182238","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Fix for critical vulnerability in JCE, extension for CMS Joomla | ProHoster","description":"In JCE (Joomla Content Editor), one of the oldest and most popular extensions in the Joomla ecosystem, a critical vulnerability (CVE-2026-48907) has been fixed, allowing the import of a profile without authentication. An attacker can exploit this vulnerability to place a profile that disables MIME-type checks and enables the upload of PHP scripts to the server. The vulnerability has been observed being used by malicious actors to install a web shell, providing remote access to the system. The vulnerability has been addressed in","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/ispravlenie-kriticheskoj-uyazvimosti-v-jce-dopolnenii-dlya-cms-joomla","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 JCE, \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0434\u043b\u044f CMS Joomla | ProHoster","og:description":"\u0412 JCE (Joomla Content Editor), \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0441\u0442\u0430\u0440\u0435\u0439\u0448\u0438\u0445 \u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0435\u0439\u0448\u0438\u0445 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0439 \u0432 \u044d\u043a\u043e\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Joomla, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-48907), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u043c\u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0444\u0438\u043b\u044c \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0444\u0438\u043b\u044f, \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0433\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 MIME-\u0442\u0438\u043f\u043e\u0432 \u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 PHP-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440. \u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 webshell, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/ispravlenie-kriticheskoj-uyazvimosti-v-jce-dopolnenii-dlya-cms-joomla","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-19T06:48:03+00:00","article:modified_time":"2026-06-19T06:48:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/182238","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=182238"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/182238\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=182238"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=182238"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=182238"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}