Description
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| joomshaper.com | Helix3 extension for Joomla | 1.0-3.1.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 8 repositories
-
shinthink/CVE-2026-49049 ★ 4 · Jul 4, 2026
Read-only vulnerability scanner for CVE-2026-49049 — Helix3 Joomla plugin unauthenticated AJAX handler
-
theendofabbys/CVE-2026-49049 ★ 0 · Oct 8, 2026
-
MataKucing-OFC/CVE-2026-49049 ★ 0 · Sep 12, 2026
-
Jenderal92/CVE-2026-49049 ★ 0 · Aug 2, 2026
Mass vulnerability scanner for CVE-2026-49049 – Unauthenticated Remote Code Execution in Joomla Helix3 plugin. Multi‑threaded, detects both executed and raw PHP payloads.
-
6ickzone/Helix3-Mass-Exploiter ★ 0 · Jul 15, 2026
Mass Exploiter for CVE-2026-49049
-
ExDev994/CVE-2026-49049 ★ 0 · Jul 13, 2026
CVE-2026-49049 Helix3 (JoomShaper) Joomla Unauthenticated AJAX RCE Scanner
-
Dr-D25/CVE-2026-49049 ★ 0 · Jul 10, 2026
-
frada321/asdsadsadasdasdsadsad ★ 0 · Jul 5, 2026
CVE-2026-49049 - Unauthenticated File Deletion, Arbitrary Write & XSS Injection for Helix3 Joomla Extension
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write http/cves/2026/CVE-2026-49049.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://www.joomshaper.com/ product