What the vulnerability does
01Description
Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10 - `Blog::remove_image()` checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path (src) belonged to that article. On Joomla 3 builds where physical file deletion was triggered, an author could supply their own article ID alongside an arbitrary file path under the `/images/` directory to delete arbitrary files.
Explanation of Vulnerability in Simple Terms
02Summary
The Helix Ultimate extension for Joomla contains an authorization bypass vulnerability in versions 1.0 through 2.2.9. An attacker with high-level privileges can manipulate user-controlled keys to bypass authorization checks and modify data. The vulnerability requires administrative or elevated account access to exploit.
What an attacker can do
03Attacker Capabilities
Modify site data by bypassing authorization checks using manipulated user-controlled keys.
Potential impact on your site
04Site Impact
Administrators with compromised accounts could have their authorization controls bypassed, allowing unauthorized data modification.
Conditions required to exploit
05Prerequisites
Attacker must have high-level Joomla privileges (administrator or equivalent account).
Key dates
06Disclosure timeline
August 31, 2026
CVE published
September 1, 2026
Record updated
