CVE-2026-78078: CWE-434 Unrestricted Upload of File with Dangerous Type in joomshaper.com Helix Ultimate extension for Joomla

The Helix Ultimate extension for Joomla versions 1.0 through 2.2.9 suffers from an unrestricted file upload vulnerability (CWE-434) where image upload validation relied solely on file extensions and basic size checks. This allowed attackers with privileges to bypass upload restrictions by disguising non-image files with raster image extensions. The fix involves implementing strict MIME type verification and using the GD library's imagecreatefromstring function to decode and validate image content, ensuring malformed or invalid images are rejected in a fail-closed manner.

An attacker with the required privileges could upload malicious files disguised as images, potentially leading to unauthorized file uploads that might be used to execute arbitrary code or compromise the system. The vulnerability has a CVSS 4.0 score of 8.9, indicating high severity with network attack vector, low attack complexity, and requiring privileges. No known exploits in the wild have been reported.

No official patch or remediation level is currently stated in the vendor advisory or CVE data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to Helix Ultimate version 2.2.10 or later once available, as the fix involves strict MIME verification and GD binary raster decoding to prevent upload of invalid images. Until then, restrict privileged user access and monitor for suspicious file uploads.