EUVD-2026-68527
GHSA-wmp3-68pg-cwp7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H reflects required high-privilege Joomla account; S:C reflects webshell execution escaping application boundary to OS level.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 - Image uploads previously validated only file extension and basic size parameters. Non-image files disguised with raster extensions could be uploaded. Added strict MIME verification and GD binary raster decoding (imagecreatefromstring) to reject invalid/malformed images fail-closed.
AnalysisAI
File upload restriction bypass in Helix Ultimate (Joomla extension by joomshaper.com) versions prior to 2.2.10 allows high-privileged authenticated users to upload arbitrary non-image files - including PHP webshells - by disguising them with raster image file extensions. The extension's upload handler validated only file extension and basic size parameters, not actual file content, enabling disguised executable files to be stored on the web server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Joomla user account with sufficient privileges to access the Helix Ultimate image upload interface - specifically an administrator-level or equivalent high-privilege role (PR:H per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.9 reflects a high-severity vector (AV:N/AC:L/AT:P/PR:H/UI:N) with full impact across vulnerable and subsequent system metrics (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Helix Ultimate to version 2.2.10 or later, which addresses the vulnerability by introducing strict MIME type verification and GD library binary raster decoding via imagecreatefromstring() in a fail-closed posture. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Joomla installations using Helix Ultimate, identify which user accounts have file upload permissions, and verify the installed version against the vulnerability scope (prior to 2.2.10). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today