CVE-2026-57830

CRITICAL

Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion < 2.2.7

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-57830. PoCs published by Is4yev.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-57830, an unauthenticated path-traversal vulnerability in JoomShaper Helix Ultimate Framework (plg_system_helixultimate <= 2.2.6). The exploit allows arbitrary file/folder deletion and directory listing via improper CSRF token validation and insufficient path sanitization, enabling cross-tenant filesystem access on shared hosting.

Description

Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion.

Exploits (1)

github WORKING POC 1 stars

by Is4yev · pythonpoc

https://github.com/Is4yev/CVE-2026-57830

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2026-57830, an unauthenticated path-traversal vulnerability in JoomShaper Helix Ultimate Framework (plg_system_helixultimate <= 2.2.6). The exploit allows arbitrary file/folder deletion and directory listing via improper CSRF token validation and insufficient path sanitization, enabling cross-tenant filesystem access on shared hosting.

Classification

Working Poc 100%

Attack Type

Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: JoomShaper Helix Ultimate Framework (plg_system_helixultimate) <= 2.2.6

No auth needed

Prerequisites: Target must have Helix Ultimate Framework plugin installed and enabled (default for Helix-Ultimate-based templates) · Attacker must harvest a valid CSRF token from the target's homepage

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1078 - Valid Accounts

mistral-large-3 · analyzed Jul 13, 2026 Full analysis →

References (1)

Core 1

Core References

Product product

https://www.joomshaper.com/joomla-templates/helixultimate

Scores

CVSS v3 9.1

EPSS 0.0030

EPSS Percentile 22.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

joomshaper.com/Helix Ultimate extension for Joomla 1.0-2.2.6

ollyo/helix_ultimate 1.0 - 2.2.6

Published Jul 13, 2026

Tracked Since Jul 13, 2026