CVE-2026-78078

Helix Ultimate, JoomShaper's Joomla template framework, previously validated image uploads using only the file extension and basic size checks, so non-image files renamed with raster image extensions (content spoofing) could be uploaded past validation (CWE-434). The flaw requires an attacker to already hold high privileges on the Joomla site, such as administrator-level access, making it primarily a post-compromise escalation path rather than an initial-entry vector. Once accepted, a disguised file is stored and served as an image, and the 8.9 CVSS 4.0 score reflects potentially high impact on the site and connected systems where such files may be executed or consumed, though exploitation success can depend on site-specific conditions. All Joomla sites running Helix Ultimate versions below 2.2.10 are affected; version 2.2.10 adds strict MIME verification and GD-based raster decoding (imagecreatefromstring) that reject invalid or malformed images fail-closed. No public proof-of-concept is known, the flaw is not on CISA's KEV list, and EPSS currently estimates only a 0.3% chance of exploitation within 30 days.

What to do: Update Helix Ultimate to version 2.2.10 or later. Audit media and upload directories for files bearing image extensions that are not actually valid images (e.g., by running MIME/file-type checks), and review administrator account security, since exploitation requires high privileges.