Quick answers
- Is CVE-2026-78075 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78075 being exploited in the wild.
- How severe is CVE-2026-78075?
- Informational severity, published 31 August 2026.
- Which products and versions are affected?
- JoomShaper Helix Ultimate before 2.2.10.
- Is there a fix for CVE-2026-78075?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-78075 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-78075?
- Check whether you run JoomShaper Helix Ultimate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a broken object-level authorization flaw in the `Blog::remove_image()` method. The function verifies that a user is authorized to edit a specific article ID, but fails to validate that the image path (src parameter) actually belongs to that article before deletion. On Joomla 3 sites with physical file deletion enabled, an authenticated author can supply any article ID they have edit access to, combined with an arbitrary file path under `/images/`, to delete files outside their intended scope. The attack requires valid author-level authentication and Joomla 3 with file deletion enabled.
Affected products
- JoomShaper Helix Ultimate before 2.2.10
Timeline
- 2026-08-31: disclosed