I just got an email urging the update to Helix v3.1.1.
However, my Joomla 5.4.6 doesn't find any updates available.
Any download link?
Thank you in advance,
Awaiting an answer
Helix Framework
Security Update Now Available for Helix 3
14 replies
marie-anne
It looks like my websites all use a version 2 and I do not find any updates? Is this security hole only in version 3? Or have updates never appeared despite cleaning caches?
Rashida Rahman Staff
Hi there!
Thanks for reaching out.
I have just checked and the update is appearing on my local installation already:
https://cleanshot.com/share/ww11W5RY
However, if you don't have that, you might found it within your JoomShaper download section. Here you go:
https://www.joomshaper.com/downloads/template/helix3
Best regards,
Mehtaz Afsana Borsha Staff
Hi,
Thanks for contacting us. Helix v3.1.1 is for the Helix3 framework. It was released on 29 June 2026. The official download is available from here:
https://www.joomshaper.com/downloads/template/helix3
You can update it manually:
- Take a complete website backup.
- Download Helix3 v3.1.1 from the download page.
- In Joomla, go to System → Install → Extensions.
- Upload and install the downloaded package over the existing version.
- Clear Joomla and browser cache afterward.
-Regards.
David
Does the security issues affect 3.0.5 also or just 3.1?
Mehtaz Afsana Borsha Staff
Hi,
It affects all old versions.
Sigrid
I am on Helix 3 with version 2.5.8 and when I update the template I get just a red "error" but no further information.
Do I need to update to another version first?
What are other minimum requirements.
The site is on Joomla 3.10.20-elts
Rashida Rahman Staff
Hi,
It seems you have got the manual download link there.
Please note that Helix3 3.x versions are compatible with Joomla 4, 5, and 6. Helix3 3.0.0 initially introduced Joomla 4 compatibility, and later versions continued to support Joomla 5 and Joomla 6.
However, I strongly recommend updating your Joomla version from Joomla 3 to Joomla 4/5/6, as Joomla 3 is no longer supported and may cause compatibility and security issues.
You may find the following guide helpful for the migration process:
https://www.joomshaper.com/blog/how-to-update-your-site-to-joomla-4
Hope this helps!
Best regards,
Sigrid
yes, I know. However, I cannot update that site today. Then could you please provide a patch update for the security fix for older versions?
copycat
When I update Helix3 to version 3.1.1 (the version that fixes the vulnerability), my website layout breaks immediately — the homepage design becomes distorted or completely misaligned.
This happens consistently on every Joomla installation where I apply the Helix3 3.1.1 update.
Rashida Rahman Staff
Hi there!
Sorry to hear about the issue you are facing after the latest update.
Could you please create a new support post with your environment details so we can investigate it further?
Please include:
- Joomla version
- PHP version
- Template/extension name and version
- Any error messages or screenshots
- Temporary login credentials (if possible) so we can check the issue directly
We will check and assist you further.
Best regards,
marie-anne
It would be very helpful if support can be very precise:
- the vulnarability affects all old versions. => helix_ultimate and helix3? Plugin and template?
The thing is, if you have working websites based on helix_ultimate, you have a working combination (plugin & template) but I just discovered that switching plugins 2 (ultimate) to 3 (helix) in combination with the ultimate template does not work very well.
Is there a solution for this problem?
Frits
Same question here.
Rashida Rahman Staff
Hi,
This update is only for the Helix3 framework, not for the Helix Ultimate framework.
Although both frameworks are developed by us, they are separate frameworks and have different structures. The update is not applicable to Helix Ultimate.
We also do not recommend using both frameworks together on the same website, as it may cause compatibility issues.
Thanks!
Best regards,
Torsten.S
It would be very helpful if support can be very precise:
the vulnarability affects all old versions. => helix_ultimate and helix3? Plugin and template?
The thing is, if you have working websites based on helix_ultimate, you have a working combination (plugin & >template) but I just discovered that switching plugins 2 (ultimate) to 3 (helix) in combination with the ultimate >template does not work very well.
Is there a solution for this problem?
Good question, i like to know this aswell.
Rashida Rahman Staff
Hi,
This update is only for the Helix3 framework, not for the Helix Ultimate framework.
Although both frameworks are developed by us, they are separate frameworks and have different structures. The update is not applicable to Helix Ultimate.
We also do not recommend using both frameworks together on the same website, as it may cause compatibility issues.
Thanks!
Best regards,
Mike Lawson
Hello, does this security risk apply to V2.x as well? That is, if I still have V2 am I at risk ?
Rashida Rahman Staff
Hi,
Could you please clarify what you mean by V2.x? Do you mean Helix Ultimate 2.x, or are you referring to the older Helix II framework (which was discontinued a long time ago)?
This update is only for the Helix3 framework, not for the Helix Ultimate framework.
Although both frameworks are developed by us, they are separate frameworks with different structures and update paths. This update is not applicable to Helix Ultimate.
We also do not recommend using both frameworks together on the same website, as it may lead to compatibility issues.
Thanks!
Best regards,
Mike Lawson
Hello, I am referring to the "System - Helix Ultimate Framework" plugin, that I currently have in version 2.2.x on my websites...which was the default template integrated when I installed the quickstart package downloaded from your site.
Rashida Rahman Staff
Well, you do not need this then, since the security update is not for Helix Ultimate Framework.
Thanks...
Joomla User
I do have several (10) old Joomla 3 sites from clients that has no time or budget yet to upgrade to J5 / J6. But they still use Helix 3 template. Update this template gives an error.
So what can we do for those websites
bergwerk
i second the request regarding details for older joomla 3 installations.
looking through the code it seems an old "helix3 ajax" plugin is the major issue - so we deactivated that on all sites and i recommend everyone running old installations to do so as well.
are any other files affected as well?
thanks!
marie-anne
Hi Bergwerk,
That's exactly what I did. For some reason I stumbled upon two sites with both version 2 and 3. I wondered it the pagebuilder had something to do with it.
Anyway, some clarity regarding older combinations would be nice. There is enough to update and migrate already.
Thanks.
Mia
Here is more info about the flaws: https://mysites.guru/blog/helix3-security-update-changelog-failure/
marie-anne
Thank you Mia, it has the answer I was looking for.
Paulie
I am currently running Helix 3.0.5 on Joomla 3.10.12 and the Helix 3.1.1 update does not work.
This error is received...
0 Call to undefined method Joomla\CMS\Installer\Installer::setDatabase()
() JROOT\tmp\install_6a42aba90ff6b\installer.script.php:46
Mia
In J3 only one of the both is updating, you maybe need to re-add the update as single update, to get both parts updated. Error is also possible about PHP version.
Log in to reply.