CVE-2026-78079
Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- EPSS probability
- 0.26%
- CWE
- CWE-601
- Published
- 2026-08-31
- Last modified
- 2026-09-01
Affected products
- joomshaper.com Helix Ultimate extension for Joomla
Weakness type
Related vulnerabilities
- CVE-2026-86756 — Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState
- CVE-2026-78377 — Open Redirect in Yordam Informatics's Library Automation System
- CVE-2026-84389 — A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0...
- CVE-2026-86351 — MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL
- CVE-2026-86256 — wger before 2.6 Open Redirect via trainer-login next parameter
- CVE-2026-86205 — h3 before 2.0.1-rc.18 Open Redirect via redirectBack()
- CVE-2026-85676 — Dub Open Redirect via Unrestricted redir_url Parameter
- CVE-2026-53728 — Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage