Helix Ultimate (shaper_helixultimate) below 2.2.7 - Unauthenticated Broken Access Control (Stored XSS and Super-User Creation via Mega Menu)
Helix Ultimate versions before 2.2.7 expose several front-end com_ajax tasks (saveMegaMenuSettings, getMenuItems and deleteMedia) with no ACL or CSRF check (CWE-862, Missing Authorization). An unauthenticated attacker can call saveMegaMenuSettings to write arbitrary content into any menu item params (the helixultimatemenulayout badge and custom_html fields in the #__menu table) and enumerate the whole menu tree via getMenuItems. In the wild this stores a self-propagating XSS payload (CWE-79) that, when a logged-in administrator renders the menu, silently creates a rogue Super User and beacons the credentials to an external server. Fixed in 2.2.7, which enforces CSRF token and permission checks across all Helix Ultimate AJAX actions; 2.2.8 is the current release. Confirmed exploited in the wild in July 2026. Action: update to 2.2.8 now, then audit #__menu params for injected script tags and #__users for unexpected Super User accounts. Temporary mitigation: block requests where option=com_ajax and plugin=helixultimate at the firewall or WAF until updated.
Affected versions: > 2.1.4-j3sec and < 2.2.7
Full advisory: www.joomshaper.com
Helix Ultimate (shaper_helixultimate) 2.2.7 to 2.2.9 - Media Upload Bypass, Path Traversal, Broken Access Control and Stored XSS
JoomShaper released Helix Ultimate 2.2.10 on 27 August 2026 as a security update, and states that all versions prior to 2.2.10 are affected. It grades the issues High / Medium. THIS ROW IS THE TEMPLATE (shaper_helixultimate), which is installed separately from the System - Helix Ultimate Framework plugin, does NOT appear in Joomla Updates, and must be downloaded from JoomShaper and installed by hand - updating the plugin alone does not clear it. Template-side fixes in 2.2.10 are: strict heading tag, CSS colour format and attribute validation in the Page Title feature (templates/shaper_helixultimate/features/title.php); hardening of index.php; and template style installer changes that scope parameter migrations by style ID and clean up obsolete SCSSPHP vendor files. The release also fixes, in the paired plugin: com_media permission enforcement on media AJAX endpoints, image upload MIME and binary raster verification, canonical realpath media path validation with null-byte detection, Live Preview and Coming Soon bypass restricted to authenticated users with template edit rights, object-level authorization on frontend article attribute saves, Mega Menu edit permission checks and JSON layout XSS sanitisation, and output encoding on video, audio and social sharing markup. The Joomla CNA published five CVEs for this release on 31 August 2026, every one of them with the affected range 1.0-2.2.9: CVE-2026-78078 (8.9 High, privileged file upload bypass via content spoofing - upload validation checked only the file extension and basic size, so a non-image disguised with a raster extension was accepted; 2.2.10 adds strict MIME verification and GD binary raster decoding that fails closed), CVE-2026-78077 (8.6 High, stored XSS in the Mega Menu layout container and embed inputs - unsanitised column and item configuration values held in the Mega Menu layout JSON were rendered without complete contextual escaping), CVE-2026-78079 (5.3 Medium, open redirect - the return redirect parameter accepted any Base64 string without checking the resolved target with Uri::isInternal), CVE-2026-78075 (5.1 Medium, broken object-level authorization in Blog::remove_image - the check validated the article id passed in the request but never confirmed that the supplied image path belonged to that article, letting an author delete arbitrary files under /images/; reported by Phil Taylor of mySites.guru) and CVE-2026-78076 (5.1 Medium, missing item-level and menu-level authorization on the save-megamenu-settings AJAX endpoint, so an authenticated user could rewrite layout parameters for arbitrary menu items). Four of the five score PR:H and need an authenticated, privileged account; only the open redirect (CVE-2026-78079) is PR:N, and that one also needs user interaction. So the original judgement stands: this is not an unauthenticated remote attack surface, unlike CVE-2026-57829 / CVE-2026-57830 below. One trap when reading the CNA records: CVE-2026-78079 is TITLED 'Privileged File Upload Bypass via Content Spoofing', a straight duplicate of CVE-2026-78078's title, while its description and its CVSS vector are the open redirect. The description is the correct half. This is the same Mega Menu surface as CVE-2026-57829 and CVE-2026-57830, exploited in the wild in July 2026, so treat it as urgent. Action: update BOTH the Helix Ultimate template and the Helix Ultimate plugin to 2.2.10 or later. Joomla 3 sites cannot install 2.2.10 - JoomShaper ships a separate J3 security patch (helixultimate_j3_security_fixes, currently v1.0.3, released 31 August 2026) which leaves the reported template version at 2.1.4-j3sec, so a J3 install gives no version evidence of its patch level and is deliberately outside this range.
Affected versions: ≥ 2.2.7 and < 2.2.10
Full advisory: github.com
Helix Ultimate (shaper_helixultimate) below 2.1.4-j3sec - Unauthenticated Broken Access Control (Stored XSS and Super-User Creation via Mega Menu) - free JoomShaper security patch available
Helix Ultimate versions below 2.1.4-j3sec expose several front-end com_ajax tasks (saveMegaMenuSettings, getMenuItems and deleteMedia) with no ACL or CSRF check (CWE-862, Missing Authorization). An unauthenticated attacker can call saveMegaMenuSettings to write arbitrary content into any menu item params (the helixultimatemenulayout badge and custom_html fields in the #__menu table) and enumerate the whole menu tree via getMenuItems. In the wild this stores a self-propagating XSS payload (CWE-79) that, when a logged-in administrator renders the menu, silently creates a rogue Super User and beacons the credentials to an external server. Confirmed exploited in the wild in July 2026. On Joomla 4 and later: update to Helix Ultimate 2.2.10 or later (the current release, published 27 August 2026). On Joomla 3, where 2.2.7 cannot be installed: apply JoomShaper's free Joomla 3 security patch (helixultimate_j3_security_fixes v1.0.3, which installs on any Helix Ultimate version and reports version 2.1.4-j3sec afterwards, clearing this alert) - mySites.guru deploys it in one click via the "Unpatched JoomShaper Security Holes" toggle in the Hacked? section of the site Snapshot. Then audit #__menu params for injected script tags and #__users for unexpected Super User accounts. Temporary mitigation: block requests where option=com_ajax and plugin=helixultimate at the firewall or WAF until patched.
Affected versions: < 2.1.4-j3sec
Full advisory: our disclosure post