JCE Pro 2.9.99.10 released

This is a security and maintenance update that fixes a file renaming issue in the filesystem along with a number of other fixes and improvements. Updating is recommended for all sites.

Security Fix - File Rename

This release fixes a file rename issue in the filesystem functions where an authenticated, privileged user - one with access to the editor, the Image Manager, File Browser etc. and permission to rename files - could rename a file in a way that created a hidden file in the folder they were browsing, instead of the rename being rejected as invalid. Renaming now rejects these names and will no longer replace a file that already exists.

Our thanks to This email address is being protected from spambots. You need JavaScript enabled to view it. for reporting this.

If you cannot update immediately: If you are concerned about this issue and are unable to update straight away, you can disable the Rename option in the settings of each file-related plugin (Image Manager, File Browser, etc.) for any profile assigned to untrusted or lower-trust users. This prevents the affected operation until the update is applied.

A general security note: across all Joomla extensions, the features and access you grant to untrusted or lower-trust users should always be kept to the minimum they actually need. Reviewing permissions periodically is good practice for any site.

Other Improvements

• Optimisation of profile loading and assignment
• The Filesystem -> Random upload file name option now offers two modes - append a random string to the uploaded name (as before), or replace it with a fully random name

Please Note: JCE Pro 2.9.99.x is compatible with Joomla 3, 4, 5 and 6, and does not require the Backwards Compatibility plugin in Joomla 5 or Joomla 6.