# Helix Ultimate 2.2.10 Fixes Twelve Security Issues, Including a Pre-Login Bypass > Helix Ultimate 2.2.10 is a security release for the Joomla template framework. Every version below it is affected. Here is what it fixes and how to update. - URL: https://mysites.guru/blog/helix-ultimate-2-2-10-security-release/ - Date: 2026-08-27 - Updated: 2026-10-12 - Category: Manage Multiple Joomla Sites - Tags: security, joomla, joomla 3, vulnerability, helix-ultimate, joomshaper, updates TL;DR: JoomShaper released Helix Ultimate 2.2.10 on 27 August 2026. It is a security release, rated High to Medium by the vendor, and every version below it is affected. The customer email groups the work into six areas; the release notes published afterwards itemise twelve security fixes and five other fixes. The one that matters most needs no login at all: a URL parameter walked past a Coming Soon holding page and served the administrator’s unsaved template settings. Joomla 4, 5 and 6 sites update through the Joomla administrator in the normal way. Joomla 3 sites need a separate package installed by hand, and three of the twelve did not reach it. Across the Joomla 4, 5 and 6 sites we monitor, around 92 percent of Helix Ultimate installs are still below 2.2.10, and most of them are on 2.2.9, exactly one release behind. Five CVEs were published for the release on 31 August, one of them ours. Helix Ultimate is a Joomla template framework from JoomShaper, installed as the `helixultimate` system plugin plus a template such as `shaper_helixultimate`. It sits underneath the whole front end of a site, which is why a security release for it is worth acting on rather than filing. If you look after more than a handful of Joomla sites, the hard part is not the update, it is knowing which sites need it. mySites.guru keeps a live inventory of every extension, template and framework on every Joomla and WordPress site in your account, so you can search for Helix Ultimate once and get every affected site with the version each one reports. The figures in this post come from that same inventory. ## What Helix Ultimate 2.2.10 Fixes These are not our findings, and it is worth saying so before describing them. This was JoomShaper’s own security pass on its own code. We did not discover or report any of it. What follows comes from reading the published code difference between 2.2.9 and 2.2.10, so we can tell customers what actually changed rather than take a changelog on trust. The one Helix-family flaw we had reported before this was in Helix3, a separate product, in June 2026. The Joomla 3 backport of this release did turn up one of ours: an authorisation check applied to the wrong object, confirming the caller could edit an article and then deleting whatever file the caller named. We reported it to JoomShaper on 27 August 2026 and they fixed it in J3 Security Fixes 1.0.3 on 31 August. It was published as [CVE-2026-78075](https://mysites.guru/vulnerabilities/CVE-2026-78075/) the same day, credited to Phil Taylor of mySites.guru, and it is the only one of the five that is ours. **Five CVEs were published for this release on 31 August 2026**, four days after it shipped, all with an affected range of 1.0 to 2.2.9 and all fixed in 2.2.10: CVE CVSS What it covers [CVE-2026-78078](https://www.cve.org/CVERecord?id=CVE-2026-78078) 8.9 High Image uploads validated only the file extension and basic size, so a non-image disguised with a raster extension was accepted. 2.2.10 adds MIME verification and GD binary raster decoding that fails closed. [CVE-2026-78077](https://www.cve.org/CVERecord?id=CVE-2026-78077) 8.6 High Stored XSS in the Mega Menu layout container and embed inputs: unsanitised column and item configuration values held in the layout JSON were rendered without complete contextual escaping. [CVE-2026-78079](https://www.cve.org/CVERecord?id=CVE-2026-78079) 5.3 Medium Open redirect. The return redirect parameter accepted arbitrary Base64 without checking the resolved target with `Uri::isInternal`. [CVE-2026-78075](https://www.cve.org/CVERecord?id=CVE-2026-78075) 5.1 Medium Broken object-level authorisation in blog image deletion. **This one is ours**, credited to Phil Taylor of mySites.guru. [CVE-2026-78076](https://www.cve.org/CVERecord?id=CVE-2026-78076) 5.1 Medium The `save-megamenu-settings` AJAX endpoint did not enforce item-level or menu-level edit permissions. Four of the five score `PR:H`, meaning they need an authenticated account with real privileges on the site. Only the open redirect is `PR:N`, and it needs user interaction. That is a materially different risk profile from the access control bypass described below, which needed no account at all and has no CVE of its own. One quirk worth knowing if you read the records directly: [CVE-2026-78079](https://mysites.guru/vulnerabilities/CVE-2026-78079/) is **titled** “Privileged File Upload Bypass via Content Spoofing”, a duplicate of [CVE-2026-78078](https://mysites.guru/vulnerabilities/CVE-2026-78078/)’s title, while its description and its CVSS vector are the open redirect. The description is the correct half. JoomShaper’s customer email gives a severity of High to Medium, an affected range of all versions prior to 2.2.10, and six areas. The release notes published on the repository go further and itemise twelve security fixes, which is the list worked through below. Reading the published code difference between 2.2.9 and 2.2.10, here is what sits behind each of them. ### Access Control on Live Preview and Coming Soon This is the most serious item and the only one reachable with no account at all. Before 2.2.10, adding `?helixMode=edit` to any URL on a Helix Ultimate site did two separate things for an anonymous visitor. It skipped the Coming Soon redirect, so an unlaunched site was served in full to anyone who knew the parameter. And it made the framework load template settings from the draft cache instead of the saved ones, so the visitor saw the administrator’s unsaved work in progress. Both now require an authenticated user with template edit rights. ### Authorisation on Media AJAX Actions The permission map behind the framework’s AJAX endpoints has been tightened. Viewing, uploading, deleting media and creating folders now each require template edit rights plus the matching `com_media` permission, rather than a single looser check. ### Mega Menu Settings and Layouts The endpoint that saves Mega Menu settings previously checked only that the caller could edit menus somewhere on the site, so anyone past that check could rewrite the Mega Menu settings of any menu item. It is now checked against the specific menu the item belongs to. The layout settings are also escaped on the way out. ### Media Upload Validation Uploads were accepted on the strength of their file extension. They are now decoded and checked, using `getimagesize`, `finfo` and a full image decode, so a file renamed to `.jpg` is rejected. The path handling underneath was also hardened with real path resolution and a null byte check, which closes a symlink route out of the media folders. ### Page Title and Attribute Validation The page title feature took its heading tag, background colour and background image straight from menu item parameters and wrote them into markup. The heading tag now comes from an allowlist, the colour must match a hex pattern, and the background image URL is quoted and escaped before it reaches the `style` attribute. ### Social Sharing and Media Embeds This one is easy to skip over and should not be. The Facebook, Twitter and LinkedIn share buttons were building their URLs by interpolating the article title and URL directly into a JavaScript string inside an `onClick` attribute. The blog video and audio layouts were taking a YouTube or Vimeo identifier out of an article’s video field and dropping it, with its query string, straight into an iframe `src`. Both are now built with `http_build_query`, escaped with `htmlspecialchars`, and the embed identifiers are restricted to an allowlist of characters. Anyone who can create an article can set a title and a video field, so this was a route into the page for a low privilege user. Three further items appear in the release notes but not in the six-area summary, and they are worth pulling out separately. ### The Draft Cache Took the Style’s Identity From the Request This sits in the same feature as the bypass above and is a different problem. When a template style was written to the draft cache, the style’s own identity came out of the POST body: `id`, `template`, `client_id`, `home` and `title` were whatever the request said they were. The stored template name is then concatenated into a filesystem path when the draft is read back, `templates//options.json` and `templates//templateDetails.xml`. 2.2.10 looks the style up in the database by its ID, takes the name from that record, and strips anything outside letters, digits, underscores and hyphens. ### Frontend Article Saves Were Not Checked Against the Article Helix Ultimate hooks `onContentBeforeSave` so it can merge its own article settings into an article’s attributes when the article is saved from the front end. It checked the context, whether the article was new, and whether the request came from the site rather than the administrator. It never checked whether this user was allowed to edit this particular article. 2.2.10 adds that check: `core.edit` on the article itself, falling back to `core.edit.own` plus an ownership test. ### Image Source URLs Were Unescaped in the Older Image Layouts The full image and intro image layouts wrote the article’s Helix image path straight into an `img src` attribute. The value is the article’s own `helix_ultimate_image` attribute, so anyone who can edit an article sets it. Both now run through `htmlspecialchars`. The layouts Joomla 5 and 6 use were already escaped. The ones fixed here are the set Helix Ultimate serves to Joomla 4 and below, which is also the set the Joomla 3 package ships. ## Five Fixes That Are Not Security The release also contains five ordinary bug fixes, and JoomShaper is explicit that these apply to Joomla 4, 5 and 6 only, not to the Joomla 3 package. The Helix system plugin now keeps its disabled state through a template update. Previously an update switched it back on, which is a real annoyance if you had turned it off. Template style migration no longer overwrites parameters between styles, so a site with several template styles will not find one style’s settings stamped over another during an update. And a frontend image lazy-loading bug is fixed. Two more deserve a line each, because one touches the update channel and the other the plugin’s own dependencies. Saving licence information used to write to every JoomShaper update site row it could find; it now resolves the right row through the extension IDs Joomla has actually recorded, in `#__update_sites_extensions`, and keeps any query string already on it. And the template installer now deletes the SCSSPHP 1.x directories that older installs left in the plugin’s `vendor` folder, where they sat alongside the 2.x version that replaced them. ## How Do I Update Helix Ultimate on Joomla 4, 5 and 6? Through the Joomla updater, in the normal way. Log in to the administrator, go to **System**, then **Update**, then **Extensions**, and update Helix Ultimate to 2.2.10. Nothing needs configuring afterwards. Clear the Joomla cache and your browser cache once it is done. Take a backup first. That is standard advice for any template framework update, because Helix Ultimate renders your entire front end and a bad update is visible to every visitor rather than tucked away in the administrator. ## What About Joomla 3 Sites? The same security issues apply to Joomla 3, but 2.2.10 will not install there. JoomShaper ships [a separate Joomla 3 package](https://joomla3security.com/vendors/joomshaper/) that has to be downloaded from GitHub and installed manually through **System**, then **Install**, then **Extensions**. That route has problems of its own, and they are worth understanding before you plan a Joomla 3 patching round. We covered them separately in [our write-up of the Joomla 3 package](https://mysites.guru/blog/helix-ultimate-third-joomla-3-security-patch/): the short version is that the Joomla updater will never offer it to you, so nothing will prompt you and you have to go and fetch it on purpose. The contents differ too. We unpacked the Joomla 3 packages from July and from today and compared them against this release. Nine of the twelve security fixes are in the Joomla 3 build, including the access control bypass. Three are not: the draft cache identity fix, the ownership check on frontend article saves, and the image source escaping described above. The third matters most on Joomla 3, because the layouts it fixes are exactly the ones that package ships, and its copy is unchanged. Details are in the [Joomla 3 write-up](https://mysites.guru/blog/helix-ultimate-third-joomla-3-security-patch/). ## How Many Sites Are Still Below 2.2.10? Across the Joomla 4, 5 and 6 sites we monitor that run Helix Ultimate, around 92 percent are still below 2.2.10. About 8 percent had already updated within hours of the release, which is what a working update channel looks like. The version distribution is the part worth knowing. The large majority of the affected installs are on 2.2.9, exactly one release behind, with a smaller group on 2.2.8. Very few are ancient. So the usual reassurance, that you keep your sites reasonably current, does not help here: JoomShaper’s advisory says everything below 2.2.10 is affected, and being one release behind puts you in that group along with everyone else. Helix Ultimate skews heavily towards the supported Joomla versions, too. About 90 percent of the installs we monitor are on Joomla 4, 5 or 6, where the normal updater works. That makes this an unusually easy security release to close out across a portfolio, provided you know which sites to look at. ## Finding Every Helix Ultimate Install in One Place Searching for an extension across a lot of Joomla sites by hand means logging into each administrator and reading the Manage screen. For twenty sites that is an afternoon. In mySites.guru, search for Helix Ultimate once in your account and you get every site running it, the version each one reports, and the Joomla version underneath, without logging into anything. From there you can see at a glance which sites are below 2.2.10, which are already done, and which are the Joomla 3 sites that need the manual package instead. That is the same inventory the percentages above came from, and it is part of the subscription rather than an add-on: GBP 19.99 per month for unlimited Joomla and WordPress sites, a price that has not changed since 2012. If a site turns out to have been compromised rather than only out of date, patching will not clean it. [fix.mysites.guru](https://fix.mysites.guru/) handles that for a single fixed fee of GBP 120 per incident, usually same day, and we screen the site before committing so you are not charged in the rare case it cannot be fixed. ## The Bottom Line Helix Ultimate 2.2.10 is a straightforward security release with one item in it that anyone on the internet could have used, and eleven more that a logged-in user with modest permissions could have. JoomShaper says every version below it is affected, and the install base we can see is overwhelmingly one release behind rather than safely current. On Joomla 4, 5 and 6 this is a normal update through the administrator, so there is little reason to leave it. Find every Helix Ultimate install you look after, update the Joomla 4, 5 and 6 ones now, and handle the Joomla 3 ones separately with the manual package. Start with a [free audit](https://mysites.guru/free-audit/) on one site if you want to see what your Helix Ultimate exposure actually looks like. ## Timeline - **2026-07-07** Helix Ultimate 2.2.7, the previous security release A batch of missing permission and token checks across the framework's AJAX handler, fixed and tagged the same day the code became public. - **2026-07-15** 2.2.9 ships as a maintenance release Menu item ID handling, an offcanvas arrow position and a copyright field. Nothing security-related in the release notes, and it is the version most sites are still running today. - **2026-07-22** Mega Menu sanitisation work is merged The first of the fixes that would become 2.2.10 goes into the repository, five weeks before the release. - **2026-08-24** Audio and video embed sanitisation is merged Embed identifiers taken from an article's video field stop being written straight into an iframe source. - **2026-08-27** Helix Ultimate 2.2.10 is released Tagged at 12:07 UTC, covering Joomla 3, 4, 5 and 6. JoomShaper rates it High to Medium and states that every version below it is affected. - **2026-08-27** Customers are emailed five minutes later The advisory gives a severity, an affected range, a fixed version and a one-line impact summary, and tells Joomla 3 users to install a separate package by hand. - **2026-08-27** Fuller release notes are published An itemised changelog goes up on the repository: twelve security fixes and five others, where the customer email had given six areas. - **2026-08-31** JoomShaper ships J3 Security Fixes v1.0.3 The Joomla 3 patch is revised to tie blog image deletion to the article's own image fields, fixing the wrong-object authorisation check that v1.0.2 introduced and that we reported on 27 August. - **2026-08-31** Five CVEs are published The Joomla CNA publishes CVE-2026-78075 through CVE-2026-78079 for the release, all affecting 1.0 to 2.2.9. CVE-2026-78075 is credited to Phil Taylor of mySites.guru. ## Further Reading - [Helix Ultimate 2.2.10 on GitHub](https://github.com/JoomShaper/helix-ultimate/releases/tag/v2.2.10) - the release tag and its pull request list. - [JoomShaper's third Joomla 3 security patch](https://mysites.guru/blog/helix-ultimate-third-joomla-3-security-patch/) - the same security work backported for Joomla 3, and why those sites cannot tell whether they have it. - [Helix Ultimate 2.2.7](https://mysites.guru/blog/helix-ultimate-security-update/) - the previous security release of the framework, from July 2026. - [Using the Joomla com_ajax interface](https://docs.joomla.org/Using_Joomla_Ajax_Interface) - how the AJAX endpoints behind several of these fixes work. - [SP Page Builder's Joomla 3 patch reaches 1.0.3](https://mysites.guru/blog/sp-page-builder-joomla-3-security-patch-1-0-3/) - the same standalone Joomla 3 patch problem in a sibling JoomShaper product, corrected after we reported two more gaps in it.