Executive brief
Helix Ultimate is a popular Joomla template that includes blog functionality for managing website content. A flaw in the image deletion feature allows article authors to delete arbitrary files from the server's `/images/` directory by manipulating file path parameters, even though they can only authenticate as authors. This could result in loss of important website assets and potential service disruption.
Technical details
The vulnerability is a broken object-level authorization flaw in the `Blog::remove_image()` method. The function verifies that a user is authorized to edit a specific article ID, but fails to validate that the image path (src parameter) actually belongs to that article before deletion. On Joomla 3 sites with physical file deletion enabled, an authenticated author can supply any article ID they have edit access to, combined with an arbitrary file path under `/images/`, to delete files outside their intended scope. The attack requires valid author-level authentication and Joomla 3 with file deletion enabled.
Affected products
- JoomShaper Helix Ultimate before 2.2.10
Timeline
- 2026-08-31: disclosed