shinthink/CVE-2026-49049

GitHubRepository PoCScanner

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based vulnerability scanner for CVE-2026-49049 that detects unauthenticated AJAX endpoints in the Helix3 Joomla plugin. It performs a non-destructive probe by writing and immediately deleting a temporary JSON file to confirm the vulnerability without exploiting it for malicious purposes.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python-based vulnerability scanner for CVE-2026-49049. The scanner performs read-only detection by writing a temporary probe file and immediately deleting it. No backdoor, concealed executable behavior, or operator-directed harm is observed in the reviewed text files.

ClassificationScanner
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareHelix3 Joomla Plugin
Attack typesImproper Access Control
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a scanner because its primary operation is to detect and validate the presence of CVE-2026-49049 without exploiting it for malicious impact. The README explicitly describes it as a 'Read-Only Vulnerability Scanner' (line 9) that performs a 'non-destructive probe' (line 7-8). The code writes a temporary file only to confirm the vulnerability and immediately deletes it (lines 219-226, 250-261), which is a detection technique, not an exploitation payload. It does not leverage the vulnerability to delete arbitrary files, write malicious content, or achieve code execution.

README.md:9README.md:78cve_2026_49049.py:219-226cve_2026_49049.py:250-261

Requirements

  • Target must be running Joomla with the Helix3 template framework (versions 1.0 through 3.1.0).README.md:15
  • The unauthenticated AJAX endpoint (index.php?option=com_ajax&plugin=helix3&format=json) must be reachable.cve_2026_49049.py:52

Observed behavior

  • Detects Joomla and Helix3 template by probing /templates/shaper_helix3/templateDetails.xml and /administrator/.cve_2026_49049.py:153-195
  • Checks if the detected Helix3 version is within the vulnerable range (1.0 – 3.1.0).cve_2026_49049.py:197-215
  • Probes the 'save' action by sending a POST request with a harmless JSON payload to the AJAX endpoint.cve_2026_49049.py:236-247
  • If the 'save' probe succeeds, probes the 'remove' action to delete the temporary file, leaving no persistent changes.cve_2026_49049.py:250-261
  • Probes the 'import' action (v3.x only) by sending a POST request with empty settings.cve_2026_49049.py:264-275
  • Outputs scan results to console and optionally to text and JSON report files.cve_2026_49049.py:95-131cve_2026_49049.py:412-441
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Scanner
CVE-2026-49049 Helix3 Joomla Plugin ScannerThe tool probes for an unauthenticated AJAX handler vulnerability. It writes a harmless JSON file to confirm the save action and deletes it to confirm the remove action, leaving no persistent changes.cve_2026_49049.py:219-279README.md:78
Network Activity
HTTP POST requests to /index.php?option=com_ajax&plugin=helix3&format=jsonThe scanner sends POST requests to the target's AJAX endpoint to test save, remove, and import actions. This is the expected behavior for a vulnerability scanner targeting CVE-2026-49049.cve_2026_49049.py:237-275
File Operation
Temporary probe file creation and deletion on targetThe scanner writes a JSON file named '_cve49049_<probe_id>.json' to the target's Helix3 layout folder and then deletes it. This is a non-destructive validation technique.cve_2026_49049.py:239-240cve_2026_49049.py:252-254
Review boundaries

What the analysis did not establish

  • One file (unclassified, 70 bytes) was omitted from the evidence; its content is unknown but unlikely to change the classification given the complete coverage of the main scanner script and README.
  • One file in the repository (total 4 files, 3 with text content) was not included in the text analysis and is reported as metadata only. Its content is unknown, but the reviewed files contain the complete scanner logic.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1