CVE-2026-49049

The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.99% chance of exploitation in the next 30 days, 60th percentile

Nuclei

high · CWE-284

Published

2026-06-29

Updated

2026-08-12

Proof-of-concept exploits (1)

• Dr-D25/CVE-2026-490490★ · 2026-07-10

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49049.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2026-49048
• CVE-2026-4905
• CVE-2026-49042
• CVE-2026-4906
• CVE-2026-4904
• CVE-2026-49069