The Helix Ultimate extension for Joomla only checked file extensions and size for uploaded images. A malicious user could upload a non‑image file – such as a PHP script – disguised with a raster extension, bypassing validation. The vulnerability, classified as CWE‑434, allows the attacker to place arbitrary files on the server that can then be executed, granting the attacker full code execution on the host.

All installations of the Helix Ultimate extension from joomshaper.com running a version earlier than 2.2.10. The vulnerability affects the Joomla component that handles image uploads through that extension.

The CVSS score of 8.9 indicates a high severity. The exploitability is high because the upload function is exposed to users with privileged upload rights, a common interface for site administrators. No EPSS value is available, and the issue is not listed in CISA’s KEV catalog, but the logical attack path – upload a malicious file and trigger execution – is straightforward and should be treated as a significant risk.