CVE-2026-78078: Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10
Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 - Image uploads previously validated only file extension and basic size parameters. Non-image files disguised with raster extensions could be uploaded. Added strict MIME verification and GD binary raster decoding (imagecreatefromstring) to reject invalid/malformed images fail-closed.
Affected Software
Event History
Frequently Asked Questions
Who is able to exploit this issue?
The issue is described as privileged, so exploitation requires access to the extension’s image-upload functionality with sufficient privileges to upload files.
Are normal image uploads affected?
The vulnerable behavior accepted files based only on extension and basic size checks. Files that were not valid images but used raster-image extensions could bypass those checks.
What changes in the fixed release?
The fix adds strict MIME verification and GD raster decoding with imagecreatefromstring. Invalid or malformed images are rejected fail-closed.