Security
Helix Ultimate 2.2.11 fixes multiple Joomla security issues
JoomShaper’s Helix Ultimate 2.2.11 addresses several security issues affecting releases from 2.0.0 through 2.2.10, but administrators must update both the framework plugin and template package.
mySites.guru published research describing the release as a vendor-rated Moderate update, with a CVSS score of about 6.5. The fixes cover cross-site scripting, path traversal and a CSRF-related rating problem. No CVE has been assigned to these issues, and mySites.guru found no evidence of active exploitation or anonymous access.
The vulnerabilities require an authenticated Joomla account with relevant editing privileges. The affected release range is 2.0.0 through 2.2.10; the fixed version is 2.2.11. The release supports Joomla 4.4, 5 and 6, not Joomla 3.
- Back up the site before making changes.
- Update the System - Helix Ultimate Framework plugin through Joomla’s extension updater.
- Download and manually install the Helix Ultimate template package from JoomShaper; it is not supplied through Joomla Updates.
- Clear the Joomla cache after installation.
Administrators should update both components on every affected site rather than installing the QuickStart package, which is intended for a new site.
Originally reported by mySites.guru.