Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-49049

Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Joomla

Description

The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

joomshaper.com Helix3 extension for Joomla

Default version status: unaffected

  • 1.0-3.1.1affected

References