CVE-2026-49049: Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler
Published Jun 29, 2026
·Updated
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.
Affected Software
2 affected components
Joomla Helix3 template plugin
Ollyo Helix3 Joomla\!>=1.0<=3.1.1
Event History
Jun 29, 2026
CVE Published
via MITRE·02:34 PM
Data Sourced
via MITRE·02:34 PM
DescriptionWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-49049?
CVE-2026-49049 has a high severity rating of 7.5 according to the CVSS 3.1 scoring system.
2
What types of vulnerabilities does CVE-2026-49049 exploit?
CVE-2026-49049 allows unauthenticated attackers to delete arbitrary files and write JSON files in the Helix3 template.
3
How do I fix CVE-2026-49049?
To fix CVE-2026-49049, update the Helix3 template plugin to the latest version released by the developer.
4
What systems are affected by CVE-2026-49049?
CVE-2026-49049 affects the Joomla Helix3 template plugin and the Ollyo Helix3 Joomla! software.
5
What can attackers do with CVE-2026-49049?
Attackers exploiting CVE-2026-49049 can delete files, write JSON data, and manipulate template parameters without any authentication.