CVE-2026-78078 Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10
Attackers can upload malicious files disguised as images in Helix Ultimate, potentially leading to code execution on Joomla sites.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-78078?
CVE-2026-78078 is a high-severity vulnerability in joomshaper.com Helix Ultimate extension for Joomla, published on 31 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 - Image uploads previously validated only file extension and basic size parameters. Non-image files disguised with raster extensions could be uploaded. Added strict MIME verification and GD binary raster decoding (imagecreatefromstring) to reject invalid/malformed images fail-closed.
Weakness: CWE-434
Which versions are affected by CVE-2026-78078?
How do I fix CVE-2026-78078?
No fix has been published for CVE-2026-78078 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-78078 being exploited?
There is no known exploitation of CVE-2026-78078 in the wild and no public exploit code.
Sources
Also known as GHSA-wmp3-68pg-cwp7.