CVE-2026-49049

EUVD-2026-40122
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 96.88%
Affected Products (NVD)
VendorProductVersion
ollyohelix3
1.0 ≤
𝑥
≤ 3.1.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.joomshaper.com/