PT-2026-83842 · Unknown · Helix Ultimate
CVE-2026-78078
·
Published
2026-08-31
·
Updated
2026-08-31
CVSS v4.0
8.9
High
| Vector | AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Helix Ultimate versions prior to 2.2.10
Description
A privileged file upload bypass exists due to content spoofing. The system previously validated image uploads based only on file extensions and basic size parameters, allowing non-image files disguised with raster extensions to be uploaded. The issue is addressed by implementing strict MIME verification and GD binary raster decoding using the
imagecreatefromstring() function to reject invalid or malformed images.Recommendations
Update Helix Ultimate to version 2.2.10 or later.
Fix
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Helix Ultimate