Executive brief
Helix Ultimate is a popular free Joomla template used to build websites. The template's image upload feature previously allowed attackers with upload privileges to bypass file type validation by disguising non-image files (such as executable scripts) with image extensions, potentially leading to remote code execution or malware injection on the website.
Technical details
This vulnerability is a file upload bypass caused by insufficient MIME type validation in the Helix Ultimate template's image upload handler. The vulnerable code validated only file extensions and basic size parameters, allowing attackers to upload malicious files (such as PHP, JSP, or other executable code) by renaming them with image extensions (.jpg, .png, etc.). The attack requires valid upload privileges on the Joomla site. Versions prior to 2.2.10 are affected. The fix implemented strict MIME verification and GD binary raster decoding using imagecreatefromstring() to reject invalid or malformed files, with fail-closed behavior ensuring rejection of suspicious uploads.
Affected products
- JoomShaper Helix Ultimate < 2.2.10
Timeline
- 2026-08-31: disclosed
- 2026-08-27: patched: Version 2.2.10 released with strict MIME verification fix