Details

Created: 01 September 2026

This maintenance updated resolves a Joomla 6 compatibility issue when editing MediaBox parameters, applies the Transition Speed parameter value to all transitions - fade in, fade out, transitions between images in a gallery - and allows the transitions to be disabled by setting the value to 0.

JCE MediaBox 3.0 Beta is also available for testing with an identical feature set to this release, but now without the jQuery dependency.

A full changelog is available to view here

Thank you to everyone who submitted bug reports and tested development versions. If you find any more issues please submit them on the forum or on github.

Download and Installation

JCE MediaBox is a free download. Forum based support is provided with a JCE Pro Subscription.

Instructions for installing and updating JCE MediaBox for each Joomla version are available here

Details

Created: 29 July 2026

This is a security and maintenance update that fixes a file renaming issue in the filesystem along with a number of other fixes and improvements. Updating is recommended for all sites.

Security Fix - File Rename

This release fixes a file rename issue in the filesystem functions where an authenticated, privileged user - one with access to the editor, the Image Manager, File Browser etc. and permission to rename files - could rename a file in a way that created a hidden file in the folder they were browsing, instead of the rename being rejected as invalid. Renaming now rejects these names and will no longer replace a file that already exists.

Our thanks to This email address is being protected from spambots. You need JavaScript enabled to view it. for reporting this.

If you cannot update immediately: If you are concerned about this issue and are unable to update straight away, you can disable the Rename option in the settings of each file-related plugin (Image Manager, File Browser, etc.) for any profile assigned to untrusted or lower-trust users. This prevents the affected operation until the update is applied.

A general security note: across all Joomla extensions, the features and access you grant to untrusted or lower-trust users should always be kept to the minimum they actually need. Reviewing permissions periodically is good practice for any site.

Other Improvements

• Optimisation of profile loading and assignment
• The Filesystem -> Random upload file name option now offers two modes - append a random string to the uploaded name (as before), or replace it with a fully random name

Please Note: JCE Pro 2.9.99.x is compatible with Joomla 3, 4, 5 and 6, and does not require the Backwards Compatibility plugin in Joomla 5 or Joomla 6.

Details

Created: 08 July 2026

This is a maintenance update that fixes an issue with directory listings not showing files with apostrophes and other valid URL characters, and an issue where editor requests were being blocked by Cloudflare and Imunify WAF (Web Application Firewall) as false-positives.

Reminder: A critical vulnerability was discovered in JCE 2.9.99.4 and earlier, and patched in 2.9.99.5, with additional security hardening in 2.9.99.6, and 2.9.99.7. If you have not yet updated, or you need to check a site for compromise, read JCE security update, and a free patch for older sites.

Update fatigue is real. Whether you run one site or many, services like BackupMonkey and MySites.guru help you keep on top of updates and apply them across everything you manage.

Please Note: JCE Pro 2.9.99.x is compatible with Joomla 3, 4, 5 and 6, and does not require the Backwards Compatibility plugin in Joomla 5 or Joomla 6.

Details

Created: 02 July 2026

This maintenance update fixes a number of issues around folder-restricted Media Fields, filenames containing special characters, and dialog display problems, alongside improvements to the reliability of profile installation and updates.

Reminder: A critical vulnerability was discovered in JCE 2.9.99.4 and earlier, and patched in 2.9.99.5, with additional security hardening in 2.9.99.6, and 2.9.99.7. If you have not yet updated, or you need to check a site for compromise, read JCE security update, and a free patch for older sites.

Update fatigue is real. Whether you run one site or many, services like BackupMonkey and MySites.guru help you keep on top of updates and apply them across everything you manage.

Please Note: JCE Pro 2.9.99.x is compatible with Joomla 3, 4, 5 and 6, and does not require the Backwards Compatibility plugin in Joomla 5 or Joomla 6.

Details

Created: 18 June 2026

This release continues the security work of the previous versions and fixes the upload problems some sites saw after 2.9.99.6.

Highlights:

• Fixes false positive PHP tag detection that was blocking legitimate image and file uploads after 2.9.99.6.
• Further hardening across the upload pipeline and profile import, continuing the defence in depth approach.
• JCE can now be installed on Joomla 3.9 and later. PHP 7.4 or later is still required.
• A new Permitted User Groups option is available in the Security tab in the Component parameters. (Components -> JCE Editor -> Control Panel, then click the Options button)
  Whitelist the groups eligible for profile assignment and import, and anything outside it is ignored. This guards against over-permissive groups slipping in, for example when importing a profile from another site, or another admin adding a group to a profile that should not be there. Empty and inactive by default, so existing sites are unaffected unless you configure it.

  

We recommend all users update.

Update fatigue is real. Whether you run one site or many, services like BackupMonkey and MySites.guru help you keep on top of updates and apply them across everything you manage.

The underlying vulnerability, CVE-2026-48907, was patched in 2.9.99.5, with additional security hardening in 2.9.99.6, and this release builds on that work. If you have not yet updated, or you need to check a site for compromise, read JCE security update, and a free patch for older sites.

Please Note: JCE Pro 2.9.99.x is compatible with Joomla 3, 4, 5 and 6, and does not require the Backwards Compatibility plugin in Joomla 5 or Joomla 6.