CVE-2026-57829 – Unauthenticated Stored XSS – Helix Ultimate for Joomla (all versions < 2.2.7)

Summary

CVE-2026-57829 is a high-severity unauthenticated stored cross-site scripting (XSS) vulnerability in Helix Ultimate, the leading template framework for Joomla CMS developed by JoomShaper, carrying a CVSS 4.0 score of 8.7 (HIGH). The flaw allows any unauthenticated remote attacker to inject persistent malicious scripts into site content via Joomla’s publicly accessible com_ajax endpoint — scripts that subsequently execute within administrator browser sessions, making this a direct admin account takeover vector. All Helix Ultimate versions prior to 2.2.7 are affected; the security patch was released on July 7, 2026.

Technical details

• Root cause: The AJAX handler registered by Helix Ultimate and exposed through Joomla’s standard com_ajax dispatcher performed no authentication check, no permission validation, and no CSRF token enforcement before processing sensitive operations. This allowed any anonymous internet visitor to invoke privileged actions — including writing to menu settings — without a valid session or credentials.
• Trigger conditions: An unauthenticated attacker sends a crafted HTTP request to the publicly accessible com_ajax endpoint targeting Helix Ultimate’s unprotected AJAX actions. No prior login, elevated privileges, or special network access are required.
• Attack vector: Network — the endpoint is reachable over the open internet on any standard Joomla installation running the extension.
• Primary impact: Stored XSS. Injected scripts are stored persistently (e.g., via unauthenticated writes to menu settings without output sanitization) and execute in the browser of any visitor or administrator who loads the affected content, enabling session hijacking and full administrator account takeover.
• Additional impacts in the same vulnerability cluster: path-traversal arbitrary file deletion anywhere within the Joomla directory structure; open redirect via unvalidated redirect targets; unprotected template settings export.
• CWEs identified: CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting); CWE-862 (Missing Authorization).

Affected software

• Helix Ultimate extension for Joomla, versions 1.0 through 2.2.6 (all versions prior to 2.2.7)
• The last public release before the security patch was version 2.2.4, released January 22, 2026

Severity

• CVSS 4.0 score: 8.7 (HIGH)
• Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Mitigation and recommended actions

• Immediate: Update Helix Ultimate to version 2.2.7 or later. JoomShaper released the initial security fix on July 7, 2026, followed by version 2.2.8; upgrading to the latest available version is strongly recommended.
• After patching, audit Joomla menu settings, site files, and administrator user accounts for signs of prior compromise (unauthorized content injection, unexpected file deletions, or new admin accounts).
• If immediate patching is not feasible, consider restricting access to the com_ajax endpoint at the web server or WAF layer as a temporary network-level mitigation.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

WAF Mitigation ✨

Akamai App & API Protector

In Akamai Control Center (Security Configuration → your security policy → Custom Rules → Create a custom rule):

• Rule logic: match ALL of the following (AND)

• Path → is one of (wildcard): /*index.php

• Method → is one of: POST

• Query Parameter → option → equals com_ajax

• Query Parameter → plugin → equals helixultimate

• Query Parameter → task → equals *savemegamenusettings*

You can also add this custom rule via Akamai API/CLI or the Akamai Custom Rule Builder Assistant:

{
  "name": "Joomla-HelixUltimate-CVE-2026-57829-unauth-menu-write",
  "description": "Blocks unauthenticated invocation of Helix Ultimate's onAjaxHelixultimate handler for the saveMegaMenuSettings action (CVE-2026-57829) via Joomla's com_ajax dispatcher. Pre-2.2.7, this handler ran with no CSRF token check and no ACL/permission check, letting anonymous visitors write attacker-controlled HTML into a menu item's stored mega-menu layout (stored XSS, admin-session takeover). The legitimate admin UI never calls this endpoint in this shape (plugin=helixultimate&task=...); it always uses a distinct helix=ultimate&request=task&action=... form under /administrator/, so this match has no known legitimate traffic origin.",
  "operation": "AND",
  "conditions": [
    {
      "type": "pathMatch",
      "positiveMatch": true,
      "value": ["/*index.php"],
      "valueWildcard": true,
      "valueCase": false
    },
    {
      "type": "requestMethodMatch",
      "positiveMatch": true,
      "value": ["POST"]
    },
    {
      "type": "uriQueryMatch",
      "positiveMatch": true,
      "name": "option",
      "nameWildcard": false,
      "nameCase": false,
      "value": ["com_ajax"],
      "valueWildcard": false,
      "valueCase": false
    },
    {
      "type": "uriQueryMatch",
      "positiveMatch": true,
      "name": "plugin",
      "nameWildcard": false,
      "nameCase": false,
      "value": ["helixultimate"],
      "valueWildcard": false,
      "valueCase": false
    },
    {
      "type": "uriQueryMatch",
      "positiveMatch": true,
      "name": "task",
      "nameWildcard": false,
      "nameCase": false,
      "value": ["*savemegamenusettings*"],
      "valueWildcard": true,
      "valueCase": false
    }
  ],
  "tag": ["CVE-2026-57829"]
}

Deploy to Akamai App & API Protector

⚠️ Note: WAF mitigation rules are in preview and not yet generally available.