CVE-2026-49049

Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.

Affected

joomshaper.com · Helix3 extension for Joomla

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.99% chance of exploitation in the next 30 days, 62nd percentile

Nuclei

high · CWE-284

Published

2026-06-29

Updated

2026-08-12

Proof-of-concept exploits (4)

• Dr-D25/CVE-2026-490490★ · 2026-07-10
• MataKucing-OFC/CVE-2026-490490★ · 2026-09-12
• 6ickzone/Helix3-Mass-Exploiter0★ · 2026-09-21
• theendofabbys/CVE-2026-490490★ · 2026-10-08

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49049.yaml

Security advisories

• https://www.joomshaper.com

References

• CVE Record
• NVD entry

Related

• CVE-2018-17254
• CVE-2023-4666
• CVE-2023-5360
• CVE-2024-2879
• CVE-2025-13486
• CVE-2026-46331