This is a critical security release. All JCE Pro users should update immediately.
A vulnerability has been identified that allowed unauthenticated users to upload editor profiles, which could be exploited to upload arbitrary files to the server. The issue has been fixed in this release.
Affected versions: All versions of JCE prior to 2.9.99.5.
Action required: Update to 2.9.99.5 via the Joomla Updater or by downloading directly from the downloads area. No configuration changes are required.
If you are unable to update, please uninstall JCE.
Thanks to David Jardin for his assistance and to Uwe Flottemesch at fc-hosting.de for reporting the issue.
Please Note: JCE Pro 2.9.99.x is compatible with Joomla 3, 4, 5 and 6, and does not require the Backwards Compatibility plugin in Joomla 5 or Joomla 6.
A changelog for this release is available to view here
Thank you to everyone who submitted bug reports and tested development versions. If you find any more issues please submit a ticket in the forum or on github.
Download and Installation
JCE Pro is available for download with a JCE Pro Subscription.
If you already have a subscription, please make sure you set your key before updating
Instructions for installing and updating JCE for each Joomla version are available here