What is the CVSS score of CVE-2026-49049?

CVE-2026-49049 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Helix3 (Joomla) are affected by CVE-2026-49049?

Joomla websites using the Helix3 template extension (versions 1.0-3.1.1) are vulnerable to unauthorized file deletion and configuration tampering by remote attackers without requiring any…

Is there a public PoC exploit available for CVE-2026-49049?

Yes, a public proof-of-concept exploit is available for CVE-2026-49049. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-49049?

Within 24 hours: Audit all Joomla instances for Helix3 extension versions 1.0-3.1.1; disable the extension if business-critical functions do not depend on it, or restrict access to the AJAX handler via firewall or WAF rules. Within 7 days: Deploy WAF policies to block requests targeting the vulnerable handler; implement file integrity monitoring to detect unauthorized modifications. Within 30 days: Monitor vendor security bulletins for patch release; upgrade Helix3 to a patched version as soon as available; audit file and configuration integrity to identify any unauthorized changes during the exposure window.

Helix3 (Joomla) CVE-2026-49049

EUVD-2026-40122 HIGH

Improper Access Control (CWE-284)

2026-06-29 Joomla

GHSA-xr7r-292v-jxg8

Authentication Bypass Helix3 Extension For Joomla Joomshaper Com

7.5

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

8.2 HIGH

Unauthenticated network endpoint with no UI gives AV:N/AC:L/PR:N/UI:N; arbitrary file write/param change yields I:H, and arbitrary file deletion adds limited availability impact (A:L), no confidentiality.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 17:21 vuln.today

CVSS changed

Jun 29, 2026 - 16:22 NVD

7.5 (HIGH)

CVE Published

Jun 29, 2026 - 14:34 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.

AnalysisAI

Improper access control in the Helix3 template framework extension for Joomla (versions 1.0 through 3.1.1) exposes an AJAX handler task that lets remote unauthenticated attackers delete arbitrary files, write arbitrary JSON files, and modify template parameters. Because the handler performs no authentication or authorization check, an attacker can corrupt site configuration or destroy files without credentials. There is no public exploit identified at time of analysis, but the issue is automatable per CISA SSVC and carries a CVSS 7.5 (High) due to its network-reachable, unauthenticated integrity impact.

Technical ContextAI

Helix3 is JoomShaper's widely used template/page-building framework for the Joomla CMS, installed as a system plugin/extension that ships theming and AJAX configuration endpoints. The flaw is classified as CWE-284 (Improper Access Control): an AJAX 'task' handler is reachable through Joomla's front-controller dispatch (typically index.php?option=...&task=...) without verifying the caller's identity or privileges. As a result, privileged template-management operations - file deletion, writing JSON parameter files, and updating template parameters - are exposed to anonymous requests. The affected component is identified by CPE cpe:2.3:a:joomshaper.com:helix3_extension_for_joomla:*:*:*:*:*:*:*:*, with all versions from 1.0 up to and including 3.1.1 in scope.

RemediationAI

No vendor-released patch version is identified in the available data; affected versions are listed as 1.0 through 3.1.1, which implies a fixed release likely exists above 3.1.1, but no exact patched version is confirmed here, so upgrade to the latest Helix3 build published by JoomShaper and confirm the fix version directly with the vendor at https://www.joomshaper.com/ before relying on it. As a compensating control until patched, restrict or block external access to the Helix3 AJAX task endpoint at the web server or WAF layer (for example, deny anonymous requests to the option/task parameters used by Helix3's ajax handler), which prevents exploitation but may break legitimate template-builder AJAX functionality for administrators; alternatively, place template-management paths behind authentication or IP allowlisting, accepting that this reduces admin convenience. Monitor web logs for anonymous requests hitting the Helix3 ajax task and for unexpected file deletions or modified template JSON parameter files. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-49049.