matakucing-ofc/cve-2026-49049Python scanner and proof-of-concept for CVE-2026-49049, an arbitrary file write in Joomla Helix3 that enables PHP web shell upload and remote code execution.
This repository contains a Python-based scanner and proof-of-concept for a vulnerability in the Joomla Helix3 component. The bug is an arbitrary file write issue that can lead to remote code execution (RCE) when an attacker is able to write a PHP payload into a web-accessible location.
The vulnerable behavior occurs when a request parameter is used to control a file path or file content without proper validation. In the case of the Helix3 AJAX interface, the endpoint accepts data that may be used to write files to the server filesystem. If the application does not restrict the destination path and does not verify the content, an attacker can create a malicious PHP script in a location that the web server executes.
In other words, the vulnerability is not just "a file can be written" — it is a dangerous chain:
This is a classic arbitrary file write to web shell scenario.
Once an attacker can write a PHP file to the site root or another executable directory, they can:
The impact is severe because it allows an attacker to turn a simple file write flaw into full server compromise.
The root problem is typically similar to this logic:
$file = $_POST['layoutName'];
$content = $_POST['content'];
file_put_contents($file, $content);
If the value of $file is attacker-controlled and the path is not restricted, the application may write PHP code to an executable path. The malicious script is then available to the browser and can be executed by the web server.
This project includes a multi-threaded Python tool that attempts to:
It records vulnerable targets in results.txt and stores raw PHP output in raw_result.txt.
The fix should eliminate untrusted file writes and enforce strict validation. Recommended remediation steps are below.
Upgrade Joomla and the Helix3 component/plugin to the latest stable version. Security updates often remove or restrict the vulnerable endpoint that allows arbitrary write operations.
If the Helix3 AJAX functionality is not necessary, disable it entirely. Removing access to the unsafe endpoint reduces the attack surface significantly.
Do not allow arbitrary filesystem paths. The application should only allow writes inside a small, fixed directory that is not publicly accessible and is not executed as PHP.
Validation should reject:
../Before writing any file:
Only trusted administrators should be allowed to use endpoints that write files. Require proper authentication and permission checks before accepting any write request.
Never write raw attacker-controlled content into executable files without strict validation. In addition, server hardening should include:
requests packageCreate a file containing the target URLs, for example targets.txt:
http://example.com
https://joomla-site.local
http://127.0.0.1
Then run:
python3 cve-2026-49049.py targets.txt
The script will create:
results.txt — vulnerable URLs detectedraw_result.txt — raw PHP payloads observed during testingThis project is intended for educational purposes, legitimate security research, and authorized vulnerability assessment. It must not be used against systems without explicit permission. Misuse is strictly prohibited.
The content in this repository is provided to help researchers and administrators understand, identify, and remediate a real security issue. Use it responsibly and only in controlled environments where you have appropriate authorization.