Helix Ultimate Framework (helixultimate) below 2.2.7 - Unauthenticated Broken Access Control (Stored XSS and Super-User Creation via Mega Menu)
Helix Ultimate versions before 2.2.7 expose several front-end com_ajax tasks (saveMegaMenuSettings, getMenuItems and deleteMedia) with no ACL or CSRF check (CWE-862, Missing Authorization). An unauthenticated attacker can call saveMegaMenuSettings to write arbitrary content into any menu item params (the helixultimatemenulayout badge and custom_html fields in the #__menu table) and enumerate the whole menu tree via getMenuItems. In the wild this stores a self-propagating XSS payload (CWE-79) that, when a logged-in administrator renders the menu, silently creates a rogue Super User and beacons the credentials to an external server. Fixed in 2.2.7, which enforces CSRF token and permission checks across all Helix Ultimate AJAX actions; 2.2.8 is the current release. Confirmed exploited in the wild in July 2026. Action: update to 2.2.8 now, then audit #__menu params for injected script tags and #__users for unexpected Super User accounts. Temporary mitigation: block requests where option=com_ajax and plugin=helixultimate at the firewall or WAF until updated.
Affected versions: > 2.1.4-j3sec and < 2.2.7
Full advisory: www.joomshaper.com
Helix Ultimate Framework (helixultimate) 2.2.7 to 2.2.9 - Media Upload Bypass, Path Traversal, Broken Access Control and Stored XSS
JoomShaper released Helix Ultimate 2.2.10 on 27 August 2026 as a security update, and states that all versions prior to 2.2.10 are affected. It grades the issues High / Medium. The fixes in this release are: strict com_media permission enforcement (core.manage, core.create, core.delete) across every media AJAX endpoint; binary raster and MIME content verification on image uploads to block upload filter bypasses; canonical realpath validation and null-byte detection on media path resolution (path traversal); draft cache path manipulation blocked by deriving template style identity from verified database records; Live Preview and Coming Soon bypass restricted to authenticated users holding template edit rights; object-level authorization and ownership checks before frontend article attributes are saved; edit permission and item validation on Mega Menu configuration; sanitisation of Mega Menu modal JSON layout settings against XSS; strict heading tag, CSS colour format and attribute validation in the Page Title feature; hardened social sharing URL generation and JavaScript handlers; strict identifier validation and output encoding on video and audio embeds; escaped image source URLs in legacy image layout overrides. The Joomla CNA published five CVEs for this release on 31 August 2026, every one of them with the affected range 1.0-2.2.9: CVE-2026-78078 (8.9 High, privileged file upload bypass via content spoofing - upload validation checked only the file extension and basic size, so a non-image disguised with a raster extension was accepted; 2.2.10 adds strict MIME verification and GD binary raster decoding that fails closed), CVE-2026-78077 (8.6 High, stored XSS in the Mega Menu layout container and embed inputs - unsanitised column and item configuration values held in the Mega Menu layout JSON were rendered without complete contextual escaping), CVE-2026-78079 (5.3 Medium, open redirect - the return redirect parameter accepted any Base64 string without checking the resolved target with Uri::isInternal), CVE-2026-78075 (5.1 Medium, broken object-level authorization in Blog::remove_image - the check validated the article id passed in the request but never confirmed that the supplied image path belonged to that article, letting an author delete arbitrary files under /images/; reported by Phil Taylor of mySites.guru) and CVE-2026-78076 (5.1 Medium, missing item-level and menu-level authorization on the save-megamenu-settings AJAX endpoint, so an authenticated user could rewrite layout parameters for arbitrary menu items). Four of the five score PR:H and need an authenticated, privileged account; only the open redirect (CVE-2026-78079) is PR:N, and that one also needs user interaction. So the original judgement stands: this is not an unauthenticated remote attack surface, unlike CVE-2026-57829 / CVE-2026-57830 below. One trap when reading the CNA records: CVE-2026-78079 is TITLED 'Privileged File Upload Bypass via Content Spoofing', a straight duplicate of CVE-2026-78078's title, while its description and its CVSS vector are the open redirect. The description is the correct half. This is the same component and the same Mega Menu surface as CVE-2026-57829 and CVE-2026-57830, which were exploited in the wild in July 2026, so treat it as urgent. Action: update Helix Ultimate to 2.2.10 or later. Note this rule covers the plugin (System - Helix Ultimate Framework); the shaper_helixultimate TEMPLATE is a separate install that does not appear in Joomla Updates and must be upgraded manually. Joomla 3 sites cannot install 2.2.10 - JoomShaper ships a separate J3 security patch (helixultimate_j3_security_fixes, currently v1.0.3, released 31 August 2026) which leaves the reported extension version at 2.1.4-j3sec, so a J3 install gives no version evidence of its patch level and is deliberately outside this range.
Affected versions: ≥ 2.2.7 and < 2.2.10
Full advisory: github.com
Helix Ultimate Framework (helixultimate) below 2.1.4-j3sec - Unauthenticated Broken Access Control (Stored XSS and Super-User Creation via Mega Menu) - free JoomShaper security patch available
Helix Ultimate versions below 2.1.4-j3sec expose several front-end com_ajax tasks (saveMegaMenuSettings, getMenuItems and deleteMedia) with no ACL or CSRF check (CWE-862, Missing Authorization). An unauthenticated attacker can call saveMegaMenuSettings to write arbitrary content into any menu item params (the helixultimatemenulayout badge and custom_html fields in the #__menu table) and enumerate the whole menu tree via getMenuItems. In the wild this stores a self-propagating XSS payload (CWE-79) that, when a logged-in administrator renders the menu, silently creates a rogue Super User and beacons the credentials to an external server. Confirmed exploited in the wild in July 2026. On Joomla 4 and later: update to Helix Ultimate 2.2.10 or later (the current release, published 27 August 2026). On Joomla 3, where 2.2.7 cannot be installed: apply JoomShaper's free Joomla 3 security patch (helixultimate_j3_security_fixes v1.0.3, which installs on any Helix Ultimate version and reports version 2.1.4-j3sec afterwards, clearing this alert) - mySites.guru deploys it in one click via the "Unpatched JoomShaper Security Holes" toggle in the Hacked? section of the site Snapshot. Then audit #__menu params for injected script tags and #__users for unexpected Super User accounts. Temporary mitigation: block requests where option=com_ajax and plugin=helixultimate at the firewall or WAF until patched.
Affected versions: < 2.1.4-j3sec
Full advisory: our disclosure post