Quick answers
- Is CVE-2026-78078 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78078 being exploited in the wild.
- How severe is CVE-2026-78078?
- Informational severity, published 31 August 2026.
- Which products and versions are affected?
- JoomShaper Helix Ultimate < 2.2.10.
- Is there a fix for CVE-2026-78078?
- A patch was published on 2026-08-27: Version 2.2.10 released with strict MIME verification fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78078 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-78078?
- Check whether you run JoomShaper Helix Ultimate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is a file upload bypass caused by insufficient MIME type validation in the Helix Ultimate template's image upload handler. The vulnerable code validated only file extensions and basic size parameters, allowing attackers to upload malicious files (such as PHP, JSP, or other executable code) by renaming them with image extensions (.jpg, .png, etc.). The attack requires valid upload privileges on the Joomla site. Versions prior to 2.2.10 are affected. The fix implemented strict MIME verification and GD binary raster decoding using imagecreatefromstring() to reject invalid or malformed files, with fail-closed behavior ensuring rejection of suspicious uploads.
Affected products
- JoomShaper Helix Ultimate < 2.2.10
Timeline
- 2026-08-31: disclosed
- 2026-08-27: patched: Version 2.2.10 released with strict MIME verification fix