CVE-2026-78079 - Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 · CoreCVE

Back Back to CVE browser

MEDIUM

Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10

Published Aug 31, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.41%

Description

Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal.

Affected products

Vendor Joomshaper.com Product Helix Ultimate extension for Joomla Default
unaffected
Affected
- 1.0-2.2.9

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Joomshaper.com	Helix Ultimate extension for Joomla	unaffected	Affected 1.0-2.2.9

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-601

Open Redirect

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-68523		Advisory
https://www.joomshaper.com/joomla-templates/helixultimate		product

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Joomla

Published Aug 31, 2026

Updated Sep 1, 2026

Reserved Aug 22, 2026

Link CVE-2026-78079

CISA Vulnrichment

Updated Aug 31, 2026

NVD

Status Deferred

Modified Aug 31, 2026

Link CVE-2026-78079

Red Hat

No data

ENISA EUVD

Assigner Joomla

Published Aug 31, 2026

Updated Sep 1, 2026

Link EUVD-2026-68523

GitHub

No data