Authenticated arbitrary file upload in JCE com_jce profile import (profiles.import)

The profiles.import task validated only a CSRF token with no core.manage check, so any authenticated user could call it. The handler ran only JFile::makeSafe() on the upload no extension/size check and wrote it via JFile::upload(..., $allow_unsafe = true), disabling Joomla's unsafe-filetype filter. A low-privileged user could thus upload a .php file to tmp_path (potential RCE). The XML parse also lacked a key whitelist (mass assignment) and entity-loader guard (XXE hardening).

This vulnerability affects the following application versions:

• Joomla Content Editor (JCE) 2.9.23



• Joomla Content Editor (JCE) 2.9.24



• Joomla Content Editor (JCE) 2.9.25



• Joomla Content Editor (JCE) 2.9.26



• Joomla Content Editor (JCE) 2.9.27



• Joomla Content Editor (JCE) 2.9.28



• Joomla Content Editor (JCE) 2.9.29



• Joomla Content Editor (JCE) 2.9.30



• Joomla Content Editor (JCE) 2.9.31



• Joomla Content Editor (JCE) 2.9.32



• Joomla Content Editor (JCE) 2.9.33



• Joomla Content Editor (JCE) 2.9.34



• Joomla Content Editor (JCE) 2.9.35



• Joomla Content Editor (JCE) 2.9.36



• Joomla Content Editor (JCE) 2.9.37



• Joomla Content Editor (JCE) 2.9.38



• Joomla Content Editor (JCE) 2.9.39



• Joomla Content Editor (JCE) 2.9.40



• Joomla Content Editor (JCE) 2.9.41



• Joomla Content Editor (JCE) 2.9.50



• Joomla Content Editor (JCE) 2.9.51



• Joomla Content Editor (JCE) 2.9.52



• Joomla Content Editor (JCE) 2.9.53



• Joomla Content Editor (JCE) 2.9.54



• Joomla Content Editor (JCE) 2.9.55



• Joomla Content Editor (JCE) 2.9.56



• Joomla Content Editor (JCE) 2.9.57



• Joomla Content Editor (JCE) 2.9.58



• Joomla Content Editor (JCE) 2.9.59



• Joomla Content Editor (JCE) 2.9.60



• Joomla Content Editor (JCE) 2.9.61



• Joomla Content Editor (JCE) 2.9.62



• Joomla Content Editor (JCE) 2.9.63



• Joomla Content Editor (JCE) 2.9.70



• Joomla Content Editor (JCE) 2.9.71



• Joomla Content Editor (JCE) 2.9.72



• Joomla Content Editor (JCE) 2.9.73



• Joomla Content Editor (JCE) 2.9.74



• Joomla Content Editor (JCE) 2.9.75



• Joomla Content Editor (JCE) 2.9.76



• Joomla Content Editor (JCE) 2.9.77



• Joomla Content Editor (JCE) 2.9.78



• Joomla Content Editor (JCE) 2.9.79



• Joomla Content Editor (JCE) 2.9.80



• Joomla Content Editor (JCE) 2.9.81



• Joomla Content Editor (JCE) 2.9.82



• Joomla Content Editor (JCE) 2.9.83



• Joomla Content Editor (JCE) 2.9.84



• Joomla Content Editor (JCE) 2.9.85



• Joomla Content Editor (JCE) 2.9.86



• Joomla Content Editor (JCE) 2.9.87



• Joomla Content Editor (JCE) 2.9.88



• Joomla Content Editor (JCE) 2.9.88.1



• Joomla Content Editor (JCE) 2.9.89



• Joomla Content Editor (JCE) 2.9.90



• Joomla Content Editor (JCE) 2.9.91



• Joomla Content Editor (JCE) 2.9.92



• Joomla Content Editor (JCE) 2.9.93



• Joomla Content Editor (JCE) 2.9.94



• Joomla Content Editor (JCE) 2.9.95



• Joomla Content Editor (JCE) 2.9.96



• Joomla Content Editor (JCE) 2.9.97



• Joomla Content Editor (JCE) 2.9.98



• Joomla Content Editor (JCE) 2.9.99



• Joomla Content Editor (JCE) 2.9.99.1



• Joomla Content Editor (JCE) 2.9.99.2



• Joomla Content Editor (JCE) 2.9.99.3



• Joomla Content Editor (JCE) 2.9.99.4



• Joomla Content Editor (JCE) 2.9.99.5