Provenance Record

Tightly scoped, well-structured KEV news story (766 words, News category). Clear sectioning (Overview, What We Know, Federal Deadline, What We Don't Know). Technical depth on the root cause is appropriate and accurately attributed to the YesWeHack disclosure. Every quantitative claim is sourced inline.

All 5 source snapshots read from disk and verified. source-0 (NVD, 200): confirms CVE-2026-48907, description quote verbatim, CVSS 4.0 10.0 Critical and CVSS 3.1 9.8 Critical both attributed to NVD, CWE-284, affected versions '1.0.0-2.9.99.4', Published Date 06/05/2026 — all match. source-1 (CISA KEV JSON, 200): confirms dateAdded 2026-06-16, dueDate 2026-06-19, knownRansomwareCampaignUse 'Unknown', shortDescription quote verbatim, BOD 26-04 required action. source-2 (SC Media, 200): confirms 83.7% of Joomla sites (2020), 1.2% of websites, three-day deadline, and the 'automated tooling spraying the same exploit at every JCE install it can reach' quote and 'hundreds of sites' both attributed to mySites.guru; the June 9 GitHub PoC claim is SC Media's. source-3 (mySites.guru, 200): confirms 3 June 2026 release of 2.9.99.5, 'insufficient access controls permitted unauthenticated users to upload editor profiles' release-note quote verbatim, 'rogue editor profile built to permit php uploads with the webshells it was used to drop still sitting on disk' verbatim, 'There is no public PoC in circulation' verbatim, Uwe Flottemesch / fc-hosting.de / David Jardin Joomla Security Strike Team, and the log/upload-dir audit guidance. source-4 (YesWeHack, 200): confirms all three root-cause weakness quotes verbatim (CSRF-token-only gate, no file-extension restriction, allow_unsafe=true disabling the safety net), the '/tmp directory ... pre-auth RCE in default or weakly hardened Joomla deployments' quote, and the >= 2.9.99.6 upgrade recommendation.

Every specific (CVE id, two CVSS scores, version range, CWE, dates added/due/published, percentages, named researchers, version numbers) traces to a cited source. The SC Media (June 9 PoC) vs mySites.guru ('no public PoC') conflict is correctly framed as a divergence between two outlets and attributed to each individually in the 'What We Don't Know' section, not asserted as fact. The article correctly states CISA lists ransomware-campaign use as 'Unknown' and that the 'hundreds of sites' figure is one researcher's observation, not a survey.

Clean APPROVE. The automated script defaulted to APPROVE_WITH_CORRECTIONS purely on the non-blocking allowlist warning; source verification surfaced zero factual or attribution issues, so no corrections record is warranted. Ready for publication.