It looks like my websites all use a version 2 and I do not find any updates? Is this security hole only in version 3? Or have updates never appeared despite cleaning caches?

Hi there!

Thanks for reaching out.

I have just checked and the update is appearing on my local installation already:

https://cleanshot.com/share/ww11W5RY

However, if you don't have that, you might found it within your JoomShaper download section. Here you go:

https://www.joomshaper.com/downloads/template/helix3

Best regards,

Hi,

Thanks for contacting us. Helix v3.1.1 is for the Helix3 framework. It was released on 29 June 2026. The official download is available from here:

https://www.joomshaper.com/downloads/template/helix3

You can update it manually:

• Take a complete website backup.
• Download Helix3 v3.1.1 from the download page.
• In Joomla, go to System → Install → Extensions.
• Upload and install the downloaded package over the existing version.
• Clear Joomla and browser cache afterward.

-Regards.

Does the security issues affect 3.0.5 also or just 3.1?

I am on Helix 3 with version 2.5.8 and when I update the template I get just a red "error" but no further information. Do I need to update to another version first? What are other minimum requirements. The site is on Joomla 3.10.20-elts

When I update Helix3 to version 3.1.1 (the version that fixes the vulnerability), my website layout breaks immediately — the homepage design becomes distorted or completely misaligned. This happens consistently on every Joomla installation where I apply the Helix3 3.1.1 update.

It would be very helpful if support can be very precise:

• the vulnarability affects all old versions. => helix_ultimate and helix3? Plugin and template?

The thing is, if you have working websites based on helix_ultimate, you have a working combination (plugin & template) but I just discovered that switching plugins 2 (ultimate) to 3 (helix) in combination with the ultimate template does not work very well.

Is there a solution for this problem?

It would be very helpful if support can be very precise:

the vulnarability affects all old versions. => helix_ultimate and helix3? Plugin and template?

The thing is, if you have working websites based on helix_ultimate, you have a working combination (plugin & >template) but I just discovered that switching plugins 2 (ultimate) to 3 (helix) in combination with the ultimate >template does not work very well.

Is there a solution for this problem?

Good question, i like to know this aswell.

Hello, does this security risk apply to V2.x as well? That is, if I still have V2 am I at risk ?

I do have several (10) old Joomla 3 sites from clients that has no time or budget yet to upgrade to J5 / J6. But they still use Helix 3 template. Update this template gives an error.

So what can we do for those websites

i second the request regarding details for older joomla 3 installations.

looking through the code it seems an old "helix3 ajax" plugin is the major issue - so we deactivated that on all sites and i recommend everyone running old installations to do so as well.

are any other files affected as well?

thanks!

Here is more info about the flaws: https://mysites.guru/blog/helix3-security-update-changelog-failure/

I am currently running Helix 3.0.5 on Joomla 3.10.12 and the Helix 3.1.1 update does not work.

This error is received...

0 Call to undefined method Joomla\CMS\Installer\Installer::setDatabase()

() JROOT\tmp\install_6a42aba90ff6b\installer.script.php:46

In J3 only one of the both is updating, you maybe need to re-add the update as single update, to get both parts updated. Error is also possible about PHP version.