EUVD-2026-68529
GHSA-39w7-gh54-79cf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated Joomla Author account (PR:L, not admin); impact limited to /images/ file deletion with no confidentiality breach (C:N, S:U).
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10 - Blog::remove_image() checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path (src) belonged to that article. On Joomla 3 builds where physical file deletion was triggered, an author could supply their own article ID alongside an arbitrary file path under the /images/ directory to delete arbitrary files.
AnalysisAI
Arbitrary file deletion within Joomla's /images/ directory is achievable in Helix Ultimate versions before 2.2.10 by authenticated Author-level users. The Blog::remove_image() method validates that the requesting user holds edit rights over the supplied article ID but performs no ownership check on the accompanying image path parameter (src), allowing an author to target files belonging to other articles or other content under /images/. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold an active Joomla account with the Author role (or higher), enabling access to the blog article management interface and the image deletion endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 5.1 (Medium) reflects the constrained impact surface: exploitation is limited to file deletion within the `/images/` directory tree, there is no confidentiality impact (VC:N), and the attack requires an authenticated account with at least Author-level Joomla privileges. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Helix Ultimate to version 2.2.10 or later, which introduces a fix for the broken authorization check in `Blog::remove_image()` to verify that the supplied image path belongs to the authorized article. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today