Executive brief
Helix Ultimate is a popular free Joomla template used to build various types of websites. The template contains an open redirect vulnerability in its return/redirect functionality that allows attackers to craft malicious links redirecting users to arbitrary external websites, potentially used in phishing attacks or credential harvesting.
Technical details
The vulnerability is an open redirect flaw in Helix Ultimate versions before 2.2.10, where return redirect parameters accept arbitrary Base64-encoded strings without validating whether the decoded target is an internal site URL. The vulnerable code fails to properly use Uri::isInternal() to verify redirect destinations. An unauthenticated attacker can craft a malicious URL containing a Base64-encoded external domain in the return parameter, which the application will decode and redirect users to without validation. When a user clicks the crafted link, they are silently redirected to the attacker's website. The vulnerability has been patched in version 2.2.10 as of August 2026.
Affected products
- JoomShaper Helix Ultimate before 2.2.10
Timeline
- 2026-08-31: disclosed