This is a security maintenance release and all users are encouraged to update as soon as possible.
Two related vulnerabilities have been identified and resolved in JCE Core and JCE Pro. All previous versions are affected.
An authenticated user could potentially access an Editor Profile that they are not assigned to and invoke filesystem actions available to that profile, but within the restrictions of that profile. Additionally, a directory parameter could be manipulated in a filesystem search function to list folder contents outside the configured directory.
Both issues have been resolved in 2.9.99.4. Exploitation required an active, authenticated Joomla session; unauthenticated access was not possible.
We were made aware of this issue via an external security report and completed our investigation and fix within 24 hours. We would like to thank the reporter for submitting their findings in good faith.
All JCE users should update to 2.9.99.4 at the earliest opportunity via the Joomla Update Manager or the JCE downloads area.
Please Note: JCE Pro is compatible with Joomla 3.10.x, 4.2+, 5 and 6, and does not require the Backwards Compatibility plugin for Joomla 5 or Joomla 6.
