This patch includes backported fixes for the JCE security vulnerability (CVE-2026-48907), for sites that cannot run the current release because of older PHP or Joomla versions.

This package patches the specific vulnerability only. It does not update JCE to the current version, it does not add any features, and it does not include the wider hardening introduced in JCE 2.9.99.6.

This package requires PHP 5.3 or later and has been tested on Joomla 3.9 and later.

You use it entirely at your own risk. Please back up first and test on a copy before you apply it to a live site.

Install using the Joomla Installer.