Helix Ultimate 2.2.11: Six Security Issues Fixed

JoomShaper has released Helix Ultimate 2.2.11, an update that addresses six security issues. They affect embedded audio and video filtering, path handling, the Media Manager, article editing, article ratings, and Mega Menu badges.

The developers have rated the overall severity as Moderate / Medium, with an overall score of approximately 6.5 on the CVSS scale. All Helix Ultimate versions from 2.0.0 through 2.2.10 are affected. The fixes are available in version 2.2.11.

Understanding the threat: what has been fixed?

Helix Ultimate 2.2.11 strengthens input validation and access control in several areas of the framework.

1. Unsafe filtering of embedded audio and video

The HTML sanitization function for embedded audio and video used the Joomla InputFilter parameters incorrectly: the listed tags and attributes were effectively treated as prohibited rather than allowed. As a result, legitimate player code could be removed, while certain dangerous HTML constructs could pass through the filter.

Version 2.2.11 introduces strict allowlist-based filtering: Helix Ultimate now permits only the expected tags and attributes required to embed audio and video safely. This reduces the risk of malicious JavaScript injection and XSS attacks.

2. Error page preset validation

The name of the selected error page preset was used to build a file path. Without sufficiently strict validation, a specially crafted value could attempt to escape the expected directory. This type of vulnerability is known as path traversal.

The preset name is now validated using a regular expression. If the value does not match the permitted format, Helix Ultimate uses a safe default instead.

3. XSS protection in the Media Manager

Output escaping has been strengthened in the media picker for the following data:

• folder names;
• file paths;
• preview content;
• breadcrumb items.

Without proper escaping, a specially crafted file or folder name could be interpreted by the browser as HTML or JavaScript. Version 2.2.11 ensures that these values are displayed safely.

4. Article editing permissions and image deletion

Helix Ultimate now additionally verifies whether a user is authorised to edit the specific article, rather than merely checking general access to the editing feature. This prevents users with insufficient permissions from modifying other users' articles.

Before deleting a blog image, the framework also verifies that the specified image reference exists and belongs to the article being processed. This reduces the risk of an unrelated file being deleted through manipulated request data.

5. CSRF protection for article ratings

Article rating requests now require a valid Joomla CSRF token. This token confirms that the action originated from the website itself rather than being silently triggered by a third-party page in the visitor's browser.

The permitted rating range is now validated as well. This prevents negative, excessively large, or otherwise invalid rating values from being submitted.

6. Sanitisation of Mega Menu badge text

Mega Menu badge text is now sanitised using Joomla InputFilter. Potentially dangerous HTML markup and JavaScript should no longer be stored and executed when the menu is displayed.

Who is at risk?

The update is required for all websites running Helix Ultimate versions from 2.0.0 through 2.2.10. The fixed version, 2.2.11, supports the following platforms:

• Joomla 4.4.x;
• Joomla 5.x;
• Joomla 6.x.

The developer lists support for PHP 8.1, 8.2, and 8.3, as well as readiness for PHP 8.4.

This update continues the previous Helix Ultimate security fixes

Version 2.2.11 is not a replacement for a single isolated patch. It continues a series of Helix Ultimate security updates:

• version 2.2.7 addressed an unauthenticated stored XSS vulnerability and arbitrary file deletion;
• version 2.2.10 strengthened the security of Live Preview, Coming Soon mode, media actions, the Mega Menu, image uploads, and frontend editing;
• version 2.2.11 addresses six additional issues discovered after the previous release.

How to resolve the problem: step-by-step instructions

Step 1: create a backup

Before updating, create a complete backup of your website's files and database. Make sure the archive can be downloaded and restored independently of the live website.

Step 2: update Helix Ultimate to version 2.2.11

1. Open the Joomla Administrator interface.
2. Go to System → Update → Extensions.
3. Click the button to check for updates.
4. Locate the Helix Ultimate update and install version 2.2.11 or later.
5. Make sure that both the template and the Helix Ultimate system plugin have been updated if they are listed as separate packages.

Step 3: clear the cache and test the website

1. Clear the Joomla and Helix Ultimate caches.
2. If you use a CDN or server-side caching, clear those caches as well.
3. Check the home page, blog articles, Mega Menu, Media Manager, embedded videos, and audio players.
4. Test the 404 error page and article rating submissions if these features are in use.

Because the embedded media filtering logic has changed, some older audio or video embeds may need to be adjusted. Do not disable security filtering to restore questionable code. Instead, replace it with the official embed code supplied by a trusted service.

Checking for signs of possible exploitation

Installing the patch closes the vulnerabilities, but it does not reverse any changes that may have been made previously. After updating, we recommend that you:

1. Check articles containing audio and video: look for unknown tags, scripts, event handlers, and embeds from unfamiliar sources.
2. Check the Mega Menu: inspect badge names and text for unexpected markup or JavaScript code.
3. Check media directories: look for unusual file and folder names, as well as recently added or deleted images.
4. Check articles and users: look for unexpected changes to published content and user accounts with excessive permissions.
5. Review server logs: check for suspicious requests involving article editing, ratings, the Media Manager, and Helix Ultimate settings.

Additional security measures

• Update Joomla to the latest release in your supported branch.
• Update all other extensions and templates, including unused components, or remove them.
• Follow the principle of least privilege: do not give editors and authors access to template settings unless they need it.
• Enable multi-factor authentication for administrators.
• Use a supported PHP version and install server security updates promptly.
• Create regular backups and keep at least one copy outside the website's server.

We can take care of everything for you

If you are unsure about template compatibility, concerned that the update may affect your website's appearance, or have already noticed suspicious changes, our specialists can help you:

• create a complete backup;
• update Helix Ultimate and Joomla;
• test the template after the update;
• identify malicious code and unauthorised changes;
• strengthen the security of the website and its administrator interface.

Submit a request List of services