CVE-2026-49049

Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler PUBLISHED

Description (CNA)

The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.

Affected (CNA)

Vendor / product	Versions
joomshaper.com / Helix3 extension for Joomla	affected 1.0-3.1.1

CWE

CWE-284

References

https://www.joomshaper.com/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.