# Helix Ultimate Framework (helixultimate) 2.2.7 to 2.2.9 - Media Upload Bypass, Path Traversal, Broken Access Control and Stored XSS [Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2026-78079 CVE-2026-78079MediumCVSS 5.3CVE published 31 August 2026Added to mySites.guru 31 August 2026 # Helix Ultimate Framework (helixultimate) 2.2.7 to 2.2.9 - Media Upload Bypass, Path Traversal, Broken Access Control and Stored XSS JoomShaper released Helix Ultimate 2.2.10 on 27 August 2026 as a security update, and states that all versions prior to 2.2.10 are affected. It grades the issues High / Medium. The fixes in this release are: strict com\_media permission enforcement (core.manage, core.create, core.delete) across every media AJAX endpoint; binary raster and MIME content verification on image uploads to block upload filter bypasses; canonical realpath validation and null-byte detection on media path resolution (path traversal); draft cache path manipulation blocked by deriving template style identity from verified database records; Live Preview and Coming Soon bypass restricted to authenticated users holding template edit rights; object-level authorization and ownership checks before frontend article attributes are saved; edit permission and item validation on Mega Menu configuration; sanitisation of Mega Menu modal JSON layout settings against XSS; strict heading tag, CSS colour format and attribute validation in the Page Title feature; hardened social sharing URL generation and JavaScript handlers; strict identifier validation and output encoding on video and audio embeds; escaped image source URLs in legacy image layout overrides. The Joomla CNA published five CVEs for this release on 31 August 2026, every one of them with the affected range 1.0-2.2.9: CVE-2026-78078 (8.9 High, privileged file upload bypass via content spoofing - upload validation checked only the file extension and basic size, so a non-image disguised with a raster extension was accepted; 2.2.10 adds strict MIME verification and GD binary raster decoding that fails closed), CVE-2026-78077 (8.6 High, stored XSS in the Mega Menu layout container and embed inputs - unsanitised column and item configuration values held in the Mega Menu layout JSON were rendered without complete contextual escaping), CVE-2026-78079 (5.3 Medium, open redirect - the return redirect parameter accepted any Base64 string without checking the resolved target with Uri::isInternal), CVE-2026-78075 (5.1 Medium, broken object-level authorization in Blog::remove\_image - the check validated the article id passed in the request but never confirmed that the supplied image path belonged to that article, letting an author delete arbitrary files under /images/; reported by Phil Taylor of mySites.guru) and CVE-2026-78076 (5.1 Medium, missing item-level and menu-level authorization on the save-megamenu-settings AJAX endpoint, so an authenticated user could rewrite layout parameters for arbitrary menu items). Four of the five score PR:H and need an authenticated, privileged account; only the open redirect (CVE-2026-78079) is PR:N, and that one also needs user interaction. So the original judgement stands: this is not an unauthenticated remote attack surface, unlike CVE-2026-57829 / CVE-2026-57830 below. One trap when reading the CNA records: CVE-2026-78079 is TITLED 'Privileged File Upload Bypass via Content Spoofing', a straight duplicate of CVE-2026-78078's title, while its description and its CVSS vector are the open redirect. The description is the correct half. This is the same component and the same Mega Menu surface as CVE-2026-57829 and CVE-2026-57830, which were exploited in the wild in July 2026, so treat it as urgent. Action: update Helix Ultimate to 2.2.10 or later. Note this rule covers the plugin (System - Helix Ultimate Framework); the shaper\_helixultimate TEMPLATE is a separate install that does not appear in Joomla Updates and must be upgraded manually. Joomla 3 sites cannot install 2.2.10 - JoomShaper ships a separate J3 security patch (helixultimate\_j3\_security\_fixes, currently v1.0.3, released 31 August 2026) which leaves the reported extension version at 2.1.4-j3sec, so a J3 install gives no version evidence of its patch level and is deliberately outside this range. Copy citation ## Is my site affected? CVE-2026-78079 is checked by 2 rules. Find the extension and release line your site runs: Extension Affected versions Fixed in What to do [Helix Ultimate Framework](https://mysites.guru/vulnerabilities/helixultimate/) from 2.2.7 up to but not including 2.2.10 2.2.10 Update Helix Ultimate Framework to 2.2.10 or later. [Helix Ultimate](https://mysites.guru/vulnerabilities/shaper-helixultimate/) from 2.2.7 up to but not including 2.2.10 2.2.10 Update Helix Ultimate to 2.2.10 or later. [Check whether your sites are affected](https://mysites.guru/free-audit/) ## How CVE-2026-78079 is scored The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw. 5.3 Medium CVSS 4.0, scored by Joomla CNA `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N` ### How it is reached - **AV:N Attack vector** - Network. Reachable across the internet - **AC:L Attack complexity** - Low. Nothing to work around, it just works - **AT:N Attack requirements** - None. Works against any affected install - **PR:N Privileges required** - None. No account needed - **UI:P User interaction** - Passive. Someone has to visit a page ### What it does to the site - **VC:L Confidentiality** - Low. Some data can be read - **VI:L Integrity** - Low. Some data can be altered - **VA:L Availability** - Low. The site slows or stutters ### What it does beyond the site - **SC:N Confidentiality** - None. Other systems keep their data - **SI:N Integrity** - None. Other systems keep their integrity - **SA:N Availability** - None. Other systems stay up The rule below is rated High for the set of 5 CVEs it covers together, not for this record on its own. ## Timeline 1. 31 August 2026CVE-2026-78079 record published by its CNA 2. 31 August 2026mySites.guru check added for Helix Ultimate Framework (from 2.2.7 up to but not including 2.2.10) 3. 31 August 2026mySites.guru check added for Helix Ultimate (from 2.2.7 up to but not including 2.2.10) ## Rule details High[CVE-2026-78075](https://mysites.guru/vulnerabilities/CVE-2026-78075/)[CVE-2026-78076](https://mysites.guru/vulnerabilities/CVE-2026-78076/)[CVE-2026-78077](https://mysites.guru/vulnerabilities/CVE-2026-78077/)[CVE-2026-78078](https://mysites.guru/vulnerabilities/CVE-2026-78078/)[CVE-2026-78079](https://mysites.guru/vulnerabilities/CVE-2026-78079/)2026-08-31 [Helix Ultimate Framework](https://mysites.guru/vulnerabilities/helixultimate/) Affected versions: ≥ 2.2.7 and < 2.2.10 Full advisory: [github.com](https://github.com/JoomShaper/helix-ultimate/releases/tag/v2.2.10) High[CVE-2026-78075](https://mysites.guru/vulnerabilities/CVE-2026-78075/)[CVE-2026-78076](https://mysites.guru/vulnerabilities/CVE-2026-78076/)[CVE-2026-78077](https://mysites.guru/vulnerabilities/CVE-2026-78077/)[CVE-2026-78078](https://mysites.guru/vulnerabilities/CVE-2026-78078/)[CVE-2026-78079](https://mysites.guru/vulnerabilities/CVE-2026-78079/)2026-08-31 [Helix Ultimate](https://mysites.guru/vulnerabilities/shaper-helixultimate/) - Helix Ultimate (shaper\_helixultimate) 2.2.7 to 2.2.9 - Media Upload Bypass, Path Traversal, Broken Access Control and Stored XSS JoomShaper released Helix Ultimate 2.2.10 on 27 August 2026 as a security update, and states that all versions prior to 2.2.10 are affected. It grades the issues High / Medium. THIS ROW IS THE TEMPLATE (shaper\_helixultimate), which is installed separately from the System - Helix Ultimate Framework plugin, does NOT appear in Joomla Updates, and must be downloaded from JoomShaper and installed by hand - updating the plugin alone does not clear it. Template-side fixes in 2.2.10 are: strict heading tag, CSS colour format and attribute validation in the Page Title feature (templates/shaper\_helixultimate/features/title.php); hardening of index.php; and template style installer changes that scope parameter migrations by style ID and clean up obsolete SCSSPHP vendor files. The release also fixes, in the paired plugin: com\_media permission enforcement on media AJAX endpoints, image upload MIME and binary raster verification, canonical realpath media path validation with null-byte detection, Live Preview and Coming Soon bypass restricted to authenticated users with template edit rights, object-level authorization on frontend article attribute saves, Mega Menu edit permission checks and JSON layout XSS sanitisation, and output encoding on video, audio and social sharing markup. The Joomla CNA published five CVEs for this release on 31 August 2026, every one of them with the affected range 1.0-2.2.9: CVE-2026-78078 (8.9 High, privileged file upload bypass via content spoofing - upload validation checked only the file extension and basic size, so a non-image disguised with a raster extension was accepted; 2.2.10 adds strict MIME verification and GD binary raster decoding that fails closed), CVE-2026-78077 (8.6 High, stored XSS in the Mega Menu layout container and embed inputs - unsanitised column and item configuration values held in the Mega Menu layout JSON were rendered without complete contextual escaping), CVE-2026-78079 (5.3 Medium, open redirect - the return redirect parameter accepted any Base64 string without checking the resolved target with Uri::isInternal), CVE-2026-78075 (5.1 Medium, broken object-level authorization in Blog::remove\_image - the check validated the article id passed in the request but never confirmed that the supplied image path belonged to that article, letting an author delete arbitrary files under /images/; reported by Phil Taylor of mySites.guru) and CVE-2026-78076 (5.1 Medium, missing item-level and menu-level authorization on the save-megamenu-settings AJAX endpoint, so an authenticated user could rewrite layout parameters for arbitrary menu items). Four of the five score PR:H and need an authenticated, privileged account; only the open redirect (CVE-2026-78079) is PR:N, and that one also needs user interaction. So the original judgement stands: this is not an unauthenticated remote attack surface, unlike CVE-2026-57829 / CVE-2026-57830 below. One trap when reading the CNA records: CVE-2026-78079 is TITLED 'Privileged File Upload Bypass via Content Spoofing', a straight duplicate of CVE-2026-78078's title, while its description and its CVSS vector are the open redirect. The description is the correct half. This is the same Mega Menu surface as CVE-2026-57829 and CVE-2026-57830, exploited in the wild in July 2026, so treat it as urgent. Action: update BOTH the Helix Ultimate template and the Helix Ultimate plugin to 2.2.10 or later. Joomla 3 sites cannot install 2.2.10 - JoomShaper ships a separate J3 security patch (helixultimate\_j3\_security\_fixes, currently v1.0.3, released 31 August 2026) which leaves the reported template version at 2.1.4-j3sec, so a J3 install gives no version evidence of its patch level and is deliberately outside this range. Affected versions: ≥ 2.2.7 and < 2.2.10 Full advisory: [github.com](https://github.com/JoomShaper/helix-ultimate/releases/tag/v2.2.10) ## Other vulnerabilities in Helix Ultimate Framework and Helix Ultimate Updating for CVE-2026-78079 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extensions. ### [Helix Ultimate Framework](https://mysites.guru/vulnerabilities/helixultimate/) Latest safe version: 2.2.10 - [CVE-2026-57829](https://mysites.guru/vulnerabilities/CVE-2026-57829/) Critical, after 2.1.4-j3sec up to but not including 2.2.7 - [CVE-2026-57830](https://mysites.guru/vulnerabilities/CVE-2026-57830/) Critical, after 2.1.4-j3sec up to but not including 2.2.7 - [CVE-2026-78075](https://mysites.guru/vulnerabilities/CVE-2026-78075/) High, from 2.2.7 up to but not including 2.2.10 - [CVE-2026-78076](https://mysites.guru/vulnerabilities/CVE-2026-78076/) High, from 2.2.7 up to but not including 2.2.10 - [CVE-2026-78077](https://mysites.guru/vulnerabilities/CVE-2026-78077/) High, from 2.2.7 up to but not including 2.2.10 - [CVE-2026-78078](https://mysites.guru/vulnerabilities/CVE-2026-78078/) High, from 2.2.7 up to but not including 2.2.10 ### [Helix Ultimate](https://mysites.guru/vulnerabilities/shaper-helixultimate/) Latest safe version: 2.2.10 - [CVE-2026-57829](https://mysites.guru/vulnerabilities/CVE-2026-57829/) Critical, after 2.1.4-j3sec up to but not including 2.2.7 - [CVE-2026-57830](https://mysites.guru/vulnerabilities/CVE-2026-57830/) Critical, after 2.1.4-j3sec up to but not including 2.2.7 - [CVE-2026-78075](https://mysites.guru/vulnerabilities/CVE-2026-78075/) High, from 2.2.7 up to but not including 2.2.10 - [CVE-2026-78076](https://mysites.guru/vulnerabilities/CVE-2026-78076/) High, from 2.2.7 up to but not including 2.2.10 - [CVE-2026-78077](https://mysites.guru/vulnerabilities/CVE-2026-78077/) High, from 2.2.7 up to but not including 2.2.10 - [CVE-2026-78078](https://mysites.guru/vulnerabilities/CVE-2026-78078/) High, from 2.2.7 up to but not including 2.2.10 ## References - [CVE-2026-78079 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-78079) - [CVE-2026-78079 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-78079) - [github.com/JoomShaper/helix-ultimate/releases/tag/v2.2.10](https://github.com/JoomShaper/helix-ultimate/releases/tag/v2.2.10) ## CVE-2026-78079 questions Show all Which versions are affected by CVE-2026-78079? [CVE-2026-78079](https://mysites.guru/vulnerabilities/CVE-2026-78079/) is covered by 2 rules: Helix Ultimate Framework from 2.2.7 up to but not including 2.2.10; Helix Ultimate from 2.2.7 up to but not including 2.2.10. How do I fix CVE-2026-78079? It depends on the extension and release line your site runs. For Helix Ultimate Framework from 2.2.7 up to but not including 2.2.10: update Helix Ultimate Framework to 2.2.10 or later. For Helix Ultimate from 2.2.7 up to but not including 2.2.10: update Helix Ultimate to 2.2.10 or later. How severe is CVE-2026-78079? Joomla CNA scores it 5.3 (Medium) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and someone has to visit a page. ## Running an affected version on a site you manage? A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day. This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/). Rules current as of 14 October 2026.