A flaw in the Helix Ultimate Joomla extension allows an authenticated author to delete arbitrary files located under the /images/ directory. The vulnerability lies in the Blog::remove_image() routine, which verifies the user’s permission to edit the referenced article but does not confirm that the image path requested belongs to that article. This missing check enables the author to supply any file path in the request, resulting in deletion of unintended files. The consequence is the loss of resources required for the website’s operation or the removal of user‑generated content, damaging data integrity and potentially causing a denial of service if critical assets are removed. The weakness is an authorization bypass, identified as CWE‑639.

The affected product is the Helix Ultimate extension for Joomla, whose versions earlier than 2.2.10 contain the flaw. The vulnerability applies to Joomla 3 builds that support physical file deletion via this extension. Users running older releases of Helix Ultimate should review their installation against the stated version threshold.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires the victim to be an author on the site and to submit a crafted request that includes an arbitrary /images/ path. Once executed, the attacker can delete any file under that directory, leading to content loss or potential site failure. While the attack surface is limited to authorized authors, the impact on site availability and data integrity is significant.