Helix Ultimate 2.2.10 Fixes Twelve Security Issues, Including a Pre-Login Bypass

TL;DR: JoomShaper released Helix Ultimate 2.2.10 on 27 August 2026. It is a security release, rated High to Medium by the vendor, and every version below it is affected. The customer email groups the work into six areas; the release notes published afterwards itemise twelve security fixes and five other fixes. The one that matters most needs no login at all: a URL parameter walked past a Coming Soon holding page and served the administrator’s unsaved template settings. Joomla 4, 5 and 6 sites update through the Joomla administrator in the normal way. Joomla 3 sites need a separate package installed by hand, and three of the twelve did not reach it. Across the Joomla 4, 5 and 6 sites we monitor, around 92 percent of Helix Ultimate installs are still below 2.2.10, and most of them are on 2.2.9, exactly one release behind.

Helix Ultimate is a Joomla template framework from JoomShaper, installed as the helixultimate system plugin plus a template such as shaper_helixultimate. It sits underneath the whole front end of a site, which is why a security release for it is worth acting on rather than filing.

If you look after more than a handful of Joomla sites, the hard part is not the update, it is knowing which sites need it. mySites.guru keeps a live inventory of every extension, template and framework on every Joomla and WordPress site in your account, so you can search for Helix Ultimate once and get every affected site with the version each one reports. The figures in this post come from that same inventory.

What Helix Ultimate 2.2.10 Fixes

These are not our findings, and it is worth saying so before describing them. This was JoomShaper’s own security pass on its own code. We did not discover or report any of it. What follows comes from reading the published code difference between 2.2.9 and 2.2.10, so we can tell customers what actually changed rather than take a changelog on trust. The one Helix-family flaw we did report was in Helix3, a separate product, in June 2026.

No CVE has been assigned for this release at the time of writing. We would read that as the paperwork not having caught up rather than a judgement on severity, and numbers can still be assigned later by a researcher or by the Joomla CNA.

JoomShaper’s customer email gives a severity of High to Medium, an affected range of all versions prior to 2.2.10, and six areas. The release notes published on the repository go further and itemise twelve security fixes, which is the list worked through below. Reading the published code difference between 2.2.9 and 2.2.10, here is what sits behind each of them.

Access Control on Live Preview and Coming Soon

This is the most serious item and the only one reachable with no account at all. Before 2.2.10, adding ?helixMode=edit to any URL on a Helix Ultimate site did two separate things for an anonymous visitor. It skipped the Coming Soon redirect, so an unlaunched site was served in full to anyone who knew the parameter. And it made the framework load template settings from the draft cache instead of the saved ones, so the visitor saw the administrator’s unsaved work in progress. Both now require an authenticated user with template edit rights.

Authorisation on Media AJAX Actions

The permission map behind the framework’s AJAX endpoints has been tightened. Viewing, uploading, deleting media and creating folders now each require template edit rights plus the matching com_media permission, rather than a single looser check.

Mega Menu Settings and Layouts

The endpoint that saves Mega Menu settings previously checked only that the caller could edit menus somewhere on the site, so anyone past that check could rewrite the Mega Menu settings of any menu item. It is now checked against the specific menu the item belongs to. The layout settings are also escaped on the way out.

Media Upload Validation

Uploads were accepted on the strength of their file extension. They are now decoded and checked, using getimagesize, finfo and a full image decode, so a file renamed to .jpg is rejected. The path handling underneath was also hardened with real path resolution and a null byte check, which closes a symlink route out of the media folders.

Page Title and Attribute Validation

The page title feature took its heading tag, background colour and background image straight from menu item parameters and wrote them into markup. The heading tag now comes from an allowlist, the colour must match a hex pattern, and the background image URL is quoted and escaped before it reaches the style attribute.

Social Sharing and Media Embeds

This one is easy to skip over and should not be. The Facebook, Twitter and LinkedIn share buttons were building their URLs by interpolating the article title and URL directly into a JavaScript string inside an onClick attribute. The blog video and audio layouts were taking a YouTube or Vimeo identifier out of an article’s video field and dropping it, with its query string, straight into an iframe src. Both are now built with http_build_query, escaped with htmlspecialchars, and the embed identifiers are restricted to an allowlist of characters. Anyone who can create an article can set a title and a video field, so this was a route into the page for a low privilege user.

Three further items appear in the release notes but not in the six-area summary, and they are worth pulling out separately.

The Draft Cache Took the Style’s Identity From the Request

This sits in the same feature as the bypass above and is a different problem. When a template style was written to the draft cache, the style’s own identity came out of the POST body: id, template, client_id, home and title were whatever the request said they were. The stored template name is then concatenated into a filesystem path when the draft is read back, templates/<name>/options.json and templates/<name>/templateDetails.xml. 2.2.10 looks the style up in the database by its ID, takes the name from that record, and strips anything outside letters, digits, underscores and hyphens.

Frontend Article Saves Were Not Checked Against the Article

Helix Ultimate hooks onContentBeforeSave so it can merge its own article settings into an article’s attributes when the article is saved from the front end. It checked the context, whether the article was new, and whether the request came from the site rather than the administrator. It never checked whether this user was allowed to edit this particular article. 2.2.10 adds that check: core.edit on the article itself, falling back to core.edit.own plus an ownership test.

Image Source URLs Were Unescaped in the Older Image Layouts

The full image and intro image layouts wrote the article’s Helix image path straight into an img src attribute. The value is the article’s own helix_ultimate_image attribute, so anyone who can edit an article sets it. Both now run through htmlspecialchars. The layouts Joomla 5 and 6 use were already escaped. The ones fixed here are the set Helix Ultimate serves to Joomla 4 and below, which is also the set the Joomla 3 package ships.

Five Fixes That Are Not Security

The release also contains five ordinary bug fixes, and JoomShaper is explicit that these apply to Joomla 4, 5 and 6 only, not to the Joomla 3 package.

The Helix system plugin now keeps its disabled state through a template update. Previously an update switched it back on, which is a real annoyance if you had deliberately turned it off. Template style migration no longer overwrites parameters between styles, so a site with several template styles will not find one style’s settings stamped over another during an update. And a frontend image lazy-loading bug is fixed.

Two more deserve a line each, because one touches the update channel and the other the plugin’s own dependencies. Saving licence information used to write to every JoomShaper update site row it could find; it now resolves the right row through the extension IDs Joomla has actually recorded, in #__update_sites_extensions, and keeps any query string already on it. And the template installer now deletes the SCSSPHP 1.x directories that older installs left in the plugin’s vendor folder, where they sat alongside the 2.x version that replaced them.

How Do I Update Helix Ultimate on Joomla 4, 5 and 6?

Through the Joomla updater, in the normal way. Log in to the administrator, go to System, then Update, then Extensions, and update Helix Ultimate to 2.2.10. Nothing needs configuring afterwards. Clear the Joomla cache and your browser cache once it is done.

Take a backup first. That is standard advice for any template framework update, because Helix Ultimate renders your entire front end and a bad update is visible to every visitor rather than tucked away in the administrator.

What About Joomla 3 Sites?

The same security issues apply to Joomla 3, but 2.2.10 will not install there. JoomShaper ships a separate Joomla 3 package that has to be downloaded from GitHub and installed manually through System, then Install, then Extensions.

That route has problems of its own, and they are worth understanding before you plan a Joomla 3 patching round. We covered them separately in our write-up of the Joomla 3 package: the short version is that the Joomla updater will never offer it to you, so nothing will prompt you and you have to go and fetch it deliberately.

The contents differ too. We unpacked the Joomla 3 packages from July and from today and compared them against this release. Nine of the twelve security fixes are in the Joomla 3 build, including the access control bypass. Three are not: the draft cache identity fix, the ownership check on frontend article saves, and the image source escaping described above. The third matters most on Joomla 3, because the layouts it fixes are exactly the ones that package ships, and its copy is unchanged. Details are in the Joomla 3 write-up.

How Many Sites Are Still Below 2.2.10?

Across the Joomla 4, 5 and 6 sites we monitor that run Helix Ultimate, around 92 percent are still below 2.2.10. About 8 percent had already updated within hours of the release, which is what a working update channel looks like.

The version distribution is the part worth knowing. The large majority of the affected installs are on 2.2.9, exactly one release behind, with a smaller group on 2.2.8. Very few are genuinely ancient. So the usual reassurance, that you keep your sites reasonably current, does not help here: JoomShaper’s advisory says everything below 2.2.10 is affected, and being one release behind puts you in that group along with everyone else.

Helix Ultimate skews heavily towards the supported Joomla versions, too. About 90 percent of the installs we monitor are on Joomla 4, 5 or 6, where the normal updater works. That makes this an unusually easy security release to close out across a portfolio, provided you know which sites to look at.

Finding Every Helix Ultimate Install in One Place

Searching for an extension across a lot of Joomla sites by hand means logging into each administrator and reading the Manage screen. For twenty sites that is an afternoon.

In mySites.guru, search for Helix Ultimate once in your account and you get every site running it, the version each one reports, and the Joomla version underneath, without logging into anything. From there you can see at a glance which sites are below 2.2.10, which are already done, and which are the Joomla 3 sites that need the manual package instead.

That is the same inventory the percentages above came from, and it is part of the subscription rather than an add-on: GBP 19.99 per month for unlimited Joomla and WordPress sites, a price that has not changed since 2012.

If a site turns out to have been compromised rather than merely out of date, patching will not clean it. fix.mysites.guru handles that for a single fixed fee of GBP 120 per incident, usually same day, and we screen the site before committing so you are not charged in the rare case it cannot be fixed.

The Bottom Line

Helix Ultimate 2.2.10 is a straightforward security release with one item in it that anyone on the internet could have used, and eleven more that a logged-in user with modest permissions could have. JoomShaper says every version below it is affected, and the install base we can see is overwhelmingly one release behind rather than safely current.

On Joomla 4, 5 and 6 this is a normal update through the administrator, so there is little reason to leave it. Find every Helix Ultimate install you look after, update the Joomla 4, 5 and 6 ones now, and handle the Joomla 3 ones separately with the manual package. Start with a free audit on one site if you want to see what your Helix Ultimate exposure actually looks like.