JCE Pro 2.9.99.7 released

This release continues the security work of the previous versions and fixes the upload problems some sites saw after 2.9.99.6.

Highlights:

• Fixes false positive PHP tag detection that was blocking legitimate image and file uploads after 2.9.99.6.
• Further hardening across the upload pipeline and profile import, continuing the defence in depth approach.
• JCE can now be installed on Joomla 3.9 and later. PHP 7.4 or later is still required.
• A new Permitted User Groups option is available in the Security tab in the Component parameters. (Components -> JCE Editor -> Control Panel, then click the Options button)
  Whitelist the groups eligible for profile assignment and import, and anything outside it is ignored. This guards against over-permissive groups slipping in, for example when importing a profile from another site, or another admin adding a group to a profile that should not be there. Empty and inactive by default, so existing sites are unaffected unless you configure it.

  

We recommend all users update.

Update fatigue is real. Whether you run one site or many, services like BackupMonkey and MySites.guru help you keep on top of updates and apply them across everything you manage.

The underlying vulnerability, CVE-2026-48907, was patched in 2.9.99.5, with additional security hardening in 2.9.99.6, and this release builds on that work. If you have not yet updated, or you need to check a site for compromise, read JCE security update, and a free patch for older sites.

Please Note: JCE Pro 2.9.99.x is compatible with Joomla 3, 4, 5 and 6, and does not require the Backwards Compatibility plugin in Joomla 5 or Joomla 6.