CVE-2026-78075
MediumCVSS 5.1Summary
A broken object-level authorization vulnerability was found in Helix Ultimate for Joomla (versions < 2.2.10) in blog image deletion. Blog::remove_image() checks if the user is authorized to edit the article, but does not verify if the image path belongs to that article. On Joomla 3 builds, an author can delete arbitrary files under /images/.
Risk Assessment
An authenticated user with author privileges can delete arbitrary files in the /images/ directory, potentially leading to data loss or site defacement.
Recommendation
Update Helix Ultimate to version 2.2.10 or later. Additionally, restrict user permissions and monitor file deletion operations.
Other vulnerabilities in Helix Ultimate
See all- CVE-2026-78079Medium
An Open Redirect vulnerability was found in Helix Ultimate for Joomla (versions < 2.2.10) via the Base64 return parameter. Redirect parameters accept arbitrary Base64 strings without verifying if the target is an internal URL.
- CVE-2026-78078High
In Helix Ultimate for Joomla before 2.2.10, a privileged file upload bypass via content spoofing was found. Previously only file extension and basic size were validated, allowing non-image files with raster extensions to be uploaded. Strict MIME verification and GD binary raster decoding were added to reject invalid images.
- CVE-2026-78077High
In Helix Ultimate for Joomla before 2.2.10, a stored XSS vulnerability was found in the MegaMenu layout. Unsanitized column and item configuration values were rendered without complete contextual escaping, allowing injection of malicious HTML/JS. Stricter sanitization and tag allowlists were implemented.
- CVE-2026-78076Medium
A missing authorization vulnerability was found in Helix Ultimate for Joomla (versions < 2.2.10) in MegaMenu settings. The AJAX endpoint save-megamenu-settings fails to enforce item-level and menu-level edit permissions. An authenticated user can modify layout parameters for arbitrary menu items without proper authorization.
- CVE-2026-57830Critical
The Joomla extension Helix Ultimate below version 2.2.7 is vulnerable to unauthenticated arbitrary file deletion. An attacker without logging in can delete any file on the server.
- CVE-2026-57829Medium
The Joomla extension Helix Ultimate before version 2.2.7 is vulnerable to unauthenticated stored XSS. An attacker can inject malicious script without authentication.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10 - `Blog::remove_image()` checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path (src) belonged to that article. On Joomla 3 builds where physical file deletion was triggered, an author could supply their own article ID alongside an arbitrary file path under the `/images/` directory to delete arbitrary files.