High severity7.5NVD Advisory· Published Jun 29, 2026· Updated Jun 30, 2026

CVE-2026-49049

Description

The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.

Affected products

Ollyo/Helix3
cpe:2.3:a:ollyo:helix3:*:*:*:*:*:joomla\!:*:*
Range: >=1.0,<=3.1.1
Joomla/Helix3llm-create

Patches

Vulnerability mechanics

References

www.joomshaper.comnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000