The vulnerability exists in the Joomla Content Editor (JCE) extension for Joomla when the versions are older than 2.20.2. An authenticated user with file‑management privileges can rename files to names that are normally disallowed, creating hidden files or inadvertently overwriting existing files. This lacking input validation leads to file system tampering that can hide malicious artifacts or corrupt legitimate files, potentially enabling further compromise or denial of service.

The Joomla Content Editor (JCE) extension distributed by joomlacontenteditor.net, affecting all official releases below version 2.20.2, including 2.9.99.10. No specific Joomla core versions are listed.

The CVSS score of 6.5 denotes medium severity. The EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires authenticated access and file‑management rights. An attacker can covertly introduce hidden files or replace critical files, potentially moving laterally, enabling persistence, or disrupting services if the overwritten files are executable or configuration files.