Helix Ultimate Framework (helixultimate) 2.2.7 to 2.2.9 - Media Upload Bypass, Path Traversal, Broken Access Control and Stored XSS

JoomShaper released Helix Ultimate 2.2.10 on 27 August 2026 as a security update, and states that all versions prior to 2.2.10 are affected. It grades the issues High / Medium. The fixes in this release are: strict com_media permission enforcement (core.manage, core.create, core.delete) across every media AJAX endpoint; binary raster and MIME content verification on image uploads to block upload filter bypasses; canonical realpath validation and null-byte detection on media path resolution (path traversal); draft cache path manipulation blocked by deriving template style identity from verified database records; Live Preview and Coming Soon bypass restricted to authenticated users holding template edit rights; object-level authorization and ownership checks before frontend article attributes are saved; edit permission and item validation on Mega Menu configuration; sanitisation of Mega Menu modal JSON layout settings against XSS; strict heading tag, CSS colour format and attribute validation in the Page Title feature; hardened social sharing URL generation and JavaScript handlers; strict identifier validation and output encoding on video and audio embeds; escaped image source URLs in legacy image layout overrides. The Joomla CNA published five CVEs for this release on 31 August 2026, every one of them with the affected range 1.0-2.2.9: CVE-2026-78078 (8.9 High, privileged file upload bypass via content spoofing - upload validation checked only the file extension and basic size, so a non-image disguised with a raster extension was accepted; 2.2.10 adds strict MIME verification and GD binary raster decoding that fails closed), CVE-2026-78077 (8.6 High, stored XSS in the Mega Menu layout container and embed inputs - unsanitised column and item configuration values held in the Mega Menu layout JSON were rendered without complete contextual escaping), CVE-2026-78079 (5.3 Medium, open redirect - the return redirect parameter accepted any Base64 string without checking the resolved target with Uri::isInternal), CVE-2026-78075 (5.1 Medium, broken object-level authorization in Blog::remove_image - the check validated the article id passed in the request but never confirmed that the supplied image path belonged to that article, letting an author delete arbitrary files under /images/; reported by Phil Taylor of mySites.guru) and CVE-2026-78076 (5.1 Medium, missing item-level and menu-level authorization on the save-megamenu-settings AJAX endpoint, so an authenticated user could rewrite layout parameters for arbitrary menu items). Four of the five score PR:H and need an authenticated, privileged account; only the open redirect (CVE-2026-78079) is PR:N, and that one also needs user interaction. So the original judgement stands: this is not an unauthenticated remote attack surface, unlike CVE-2026-57829 / CVE-2026-57830 below. One trap when reading the CNA records: CVE-2026-78079 is TITLED 'Privileged File Upload Bypass via Content Spoofing', a straight duplicate of CVE-2026-78078's title, while its description and its CVSS vector are the open redirect. The description is the correct half. This is the same component and the same Mega Menu surface as CVE-2026-57829 and CVE-2026-57830, which were exploited in the wild in July 2026, so treat it as urgent. Action: update Helix Ultimate to 2.2.10 or later. Note this rule covers the plugin (System - Helix Ultimate Framework); the shaper_helixultimate TEMPLATE is a separate install that does not appear in Joomla Updates and must be upgraded manually. Joomla 3 sites cannot install 2.2.10 - JoomShaper ships a separate J3 security patch (helixultimate_j3_security_fixes, currently v1.0.3, released 31 August 2026) which leaves the reported extension version at 2.1.4-j3sec, so a J3 install gives no version evidence of its patch level and is deliberately outside this range.

Affected versions: ≥ 2.2.7 and < 2.2.10

Official record: cve.org · NVD

Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.

Affected extensions and versions