Joomla Helix Ultimate: Five Vulnerabilities Including XSS and File Upload Bypass Disclosed Together
Key findings • Five vulnerabilities disclosed in Joomla's Helix Ultimate extension on August 31, 2026. • Vulnerabilities include Stored XSS, File Upload Bypass, Broken Access Control, and Ope…
Key findings
- Five vulnerabilities disclosed in Joomla's Helix Ultimate extension on August 31, 2026.
- Vulnerabilities include Stored XSS, File Upload Bypass, Broken Access Control, and Open Redirect.
- All issues affect versions prior to Helix Ultimate 2.2.10.
- The patched version is 2.2.10, and users should update immediately.
- High severity flaws include Stored XSS and Privileged File Upload Bypass.
On August 31, 2026, a batch of five vulnerabilities was disclosed in Joomla Extension - Helix Ultimate, a popular Joomla component developed by joomshaper.com. The vulnerabilities, all patched in version 2.2.10, range in severity from Medium to High and were reported on the same day, indicating a coordinated disclosure event. These issues collectively impact the security and integrity of websites using the Helix Ultimate extension.
The vulnerabilities identified include:
- Stored Cross-Site Scripting (XSS): CVE-2026-78077 allows for the injection of malicious HTML into the MegaMenu layout, which is then rendered without proper escaping. This could lead to arbitrary code execution in the context of a user's browser.
- Privileged File Upload Bypass: CVE-2026-78078 bypasses security checks for image uploads. Attackers could disguise non-image files with raster extensions, uploading malicious content by exploiting a weakness in the file extension validation. The fix includes strict MIME verification and GD binary raster de-obfuscation.
- Broken Access Control and Missing Authorization: CVE-2026-78076 affects the MegaMenu settings. The
save-megamenu-settingsAJAX endpoint failed to enforce necessary edit permissions, allowing authenticated users to potentially modify menu settings without proper authorization. - Broken Object-Level Authorization: CVE-2026-78075 involves the deletion of blog images. While the
Blog::remove_image()function checked for article edit permissions, it did not verify if the specified image path belonged to the article, potentially allowing unauthorized deletion of images associated with other articles. - Open Redirect: CVE-2026-78079 permits open redirects by accepting arbitrary Base64 encoded strings in the
Returnparameter without validating if the resolved URL was an internal site. This could be exploited to redirect users to malicious external sites.
All five vulnerabilities were addressed in Helix Ultimate version 2.2.10. Users of the Helix Ultimate extension are strongly advised to update to this latest version to mitigate the risks associated with these security flaws. The coordinated disclosure of these vulnerabilities highlights the importance of timely patching for Joomla extensions to maintain website security.