CVE-2026-49049

🗓️ 29 Jun 2026 14:34:07Reported by JoomlaType

cve🔗 web.nvd.nist.gov👁 146 Views🌐 WEB

Unauthenticated access to Helix3 ajax handler enables deleting files, writing JSON, and updating template parameters.

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for Improper Access Control in Ollyo Helix3	13 Jul 202619:38	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Ollyo Helix3	10 Jul 202608:26	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Ollyo Helix3	4 Jul 202616:28	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Ollyo Helix3	5 Jul 202612:52	–	githubexploit
ATTACKERKB	CVE-2026-49049	29 Jun 202614:34	–	attackerkb
Circl	CVE-2026-49049	29 Jun 202616:04	–	circl
Cvelist	CVE-2026-49049 Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler	29 Jun 202614:34	–	cvelist
EUVD	EUVD-2026-40122	29 Jun 202614:34	–	euvd
NVD	CVE-2026-49049	29 Jun 202615:16	–	nvd
Positive Technologies	PT-2026-53282	29 Jun 202600:00	–	ptsecurity

NVD

Node

ollyo helix3Range1.0–3.1.1joomla!

[
  {
    "defaultStatus": "unaffected",
    "product": "Helix3 extension for Joomla",
    "vendor": "joomshaper.com",
    "versions": [
      {
        "status": "affected",
        "version": "1.0-3.1.1"
      }
    ]
  }
]

Source	Link
joomshaper	www.joomshaper.com/

Parameter	Position	Path	Description	CWE
data[action]	request body	index.php?option=com_ajax&plugin=helix3&format=json	Unauthenticated AJAX action 'save' writes attacker-controlled content to a JSON file in the Helix3 layout path (path traversal possible via layoutName).	CWE-284
data[layoutName]	request body	index.php?option=com_ajax&plugin=helix3&format=json	Unauthenticated AJAX action 'save' writes attacker-controlled content to a JSON file in the Helix3 layout path (path traversal possible via layoutName).	CWE-284
data[content]	request body	index.php?option=com_ajax&plugin=helix3&format=json	Unauthenticated AJAX action 'save' writes attacker-controlled content to a JSON file in the Helix3 layout path (path traversal possible via layoutName).	CWE-284
data[action]	request body	index.php?option=com_ajax&plugin=helix3&format=json	Unauthenticated AJAX action 'remove' deletes arbitrary files specified by layoutName (no extension/path restriction).	CWE-284
data[layoutName]	request body	index.php?option=com_ajax&plugin=helix3&format=json	Unauthenticated AJAX action 'remove' deletes arbitrary files specified by layoutName (no extension/path restriction).	CWE-284
data[action]	request body	index.php?option=com_ajax&plugin=helix3&format=json	Unauthenticated AJAX action 'import' overwrites stored template parameters in the database (v3.x only).	CWE-284
data[template_id]	request body	index.php?option=com_ajax&plugin=helix3&format=json	Unauthenticated AJAX action 'import' overwrites stored template parameters in the database (v3.x only).	CWE-284
data[settings]	request body	index.php?option=com_ajax&plugin=helix3&format=json	Unauthenticated AJAX action 'import' overwrites stored template parameters in the database (v3.x only).	CWE-284

05 Jul 2026 14:29Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00228

SSVC

CWE-284