Security
JoomShaper patches serious Helix Ultimate security flaws
JoomShaper has released Helix Ultimate 2.2.7 to fix multiple Joomla security issues, including an unauthenticated menu write that could lead to stored XSS.
mySites.guru reported that all Helix Ultimate versions below 2.2.7 are affected. The previous public release was 2.2.4. The vendor's security release addresses missing CSRF and authorisation checks in the framework's com_ajax handler, including menu and mega-menu operations.
The most serious issue described is an anonymous ability to write attacker-controlled menu data, combined with unescaped output. This creates a stored cross-site scripting risk, classified as CWE-79. The missing-authorisation issues are classified as CWE-862. Other fixes cover an in-folder arbitrary file deletion, an open redirect, an unprotected template settings export, and weak media-upload validation.
No CVE has been assigned, and the report says there is no evidence of exploitation in the wild. It is not considered a zero-day, although the public patch may help attackers develop exploits. Administrators should update every affected installation to 2.2.7 without delay.
Originally reported by mySites.guru.