PT-2026-53282 · Joomla · Helix3

Phil Taylor · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-49049

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Helix3 plugin for Joomla (affected versions not specified)

Description An ajax handler task allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files, and update template parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-49049

Affected Products

Helix3

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-49049 · Security Note
• https://twitter.com/CVEnew/status/2071643304416985536 · Twitter Post
• https://joomshaper.com · Note
• https://twitter.com/infoflowcloud/status/2071643801777488103 · Twitter Post