Vulnerability · Published Aug 31, 2026 · Assigned by Joomla
CVE-2026-78078Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10
High 8.9
In plain English
A high-severity unrestricted file upload in Helix Ultimate extension for Joomla from joomshaper.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Official description
Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 - Image uploads previously validated only file extension and basic size parameters. Non-image files disguised with raster extensions could be uploaded. Added strict MIME verification and GD binary raster decoding (imagecreatefromstring) to reject invalid/malformed images fail-closed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| joomshaper.com | Helix Ultimate extension for Joomla | 1.0-2.2.9 |
Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H