Security vulnerability

Helix3 template framework – critical vulnerabilities

Critical Actively exploitedCVE: Requested (reporter: Phil Taylor, mySites.guru)

Act now

Update Helix3 to version 3.1.2 (or newer) immediately.

Download the secure version Go to the update steps

Secure version: Helix3 3.1.2 or newer · via JoomShaper (account required)

At a glance

Affected extension

Helix3 – system & AJAX plugin (plg_ajax_helix3)

Vendor

JoomShaper

Type of flaw

Several critical flaws: unauthenticated file write/delete, overwriting of template settings, privilege escalation up to code execution (PHP upload), plus XSS

Affected versions

All versions before 3.1.1

Secure version

Helix3 3.1.2 or newer Download

Severity

Critical · actively exploited

CVE

Requested (reporter: Phil Taylor, mySites.guru)

Joomla compatibility

Joomla 4 / 5 / 6

Status / published

Published/patched: 29 June 2026 (reported: 28 June 2026)

What is this about?

Helix3 is JoomShaper's classic template framework, running as a system plugin together with an AJAX plugin (plg_ajax_helix3). Several vulnerabilities were found in this AJAX plugin that can be reached via the standard com_ajax endpoint without authentication.

Specifically described are, among others: an unauthenticated write access to files (path manipulation via the save action), deletion of arbitrary files (remove/remove_image), overwriting of template settings (import) and – once logged in – privilege escalation up to code execution, because the image upload also accepted .php files. There are also stored/reflected XSS issues and a Google Fonts API key left in the source.

The fix has been available since 29 June 2026 as Helix3 3.1.1; version 3.1.2 has since been released, so update straight to it. A CVE number had been requested but not yet assigned at the time of disclosure; the reporter named is Phil Taylor of mySites.guru.

Helix3 is not Helix Ultimate

Helix3 is the older framework (system + AJAX plugin). Helix Ultimate is a separate, newer template with its own codebase and version numbering – it is not affected by this advisory.

A note on transparency

The public changelog entry initially read only "Security Update" – with no severity rating. Don't rely on changelogs alone: always update security-relevant extensions promptly.

Am I affected? – How to check

Open the back end
Log in to the Joomla administrator (the address ends in /administrator).
Go to Plugins
Open System›Plugins (alternatively Extensions›Manage›Manage).
Filter for "Helix3"
Search for Helix3 or "System – Helix3 Framework" and read off the version number shown.
Assess the version
If the version is below 3.1.2, update it – versions before 3.1.1 are acutely vulnerable.

How to fix it

Before any update: back up

Back up your files and database before updating – so you can roll back if anything goes wrong (e.g. via Akeeba Backup or your host).

Open the Update center
Go to System›Update›Extensions and click Check for updates.
Update Helix3
Select the Helix3 entry and click Update. Version 3.1.2 is delivered via the JoomShaper update server.
Verify success
Check under System›Plugins that 3.1.2 (or newer) is now shown.

Manual installation (alternative)

If no update appears, download the package from your JoomShaper account and install it via Extensions›Manage›Install.

Download the secure version

Official source: via JoomShaper (account required). Make sure you have at least Helix3 3.1.2 or newer.

Has the site already been attacked?

An update does not remove existing malware

If the site was unpatched during the exposure window, check after updating: unexpected files in the template folder, missing protection files (e.g. .htaccess) and unexplained changes to the template style parameters. When in doubt, have the site professionally cleaned and change all passwords.

Typical symptom: defacement via injected “Custom Javascript”

A frequently seen sign of this flaw: attackers inject malicious JavaScript straight into the Helix3 template options – into the Custom Code›Custom Javascript field. On page load, this code overwrites the whole page with a defacement – e.g. “Hacked by trenggalek6etar”, “Hacked by antonkill” or similar “Hacked by …” messages.

          ☠
          HACKED BY
          TRENGGALEK6ETAR
        

This is what visitors see (recreated example).

document.addEventListener("DOMContentLoaded", function(){
  document.title = "hacked by trenggalek6etar";
  document.body.innerHTML =
    '<div style="position:fixed;inset:0;'
    + 'background:#0a0a0a;z-index:2147483647">'
    + ' … HACKED BY trenggalek6etar … '
    + '</div>';
});

The injected code in the Custom Javascript field of the Helix3 template options.

How to check: in the back end under Extensions›Templates›Styles›(your Helix3 style)›Custom Code›Custom Javascript. If you find foreign code like document.title = "hacked by…" or document.body.innerHTML = …, the site is compromised: remove the code, close the root cause with the Helix3 update, and change all passwords.

Need help with the clean-up? Find qualified specialists in the Joomla Service Providers Directory.

Restore the template options from a database backup

Helix3 stores all template options (logo, colours, layout, custom CSS/JS …) as JSON in the params column of the #__template_styles table – one row per style. If they were lost to a hack, a failed update or an accidental reset, write back only that one params value from a DB backup, not the whole table.

Find the active style
Front-end styles have client_id = 0; the active one also has home = 1. Note its ID.
Locate the backup row
In the dump, find the #__template_styles row with the same template name.
Save the current value
First copy the current params value of the live row.
Overwrite params
Replace only params of that single row with the backup value.
Verify
The homepage loads (HTTP 200) and the options are back.

SELECT id, template, home FROM #__template_styles WHERE client_id = 0;
UPDATE #__template_styles SET params = '<JSON from backup>' WHERE id = 12;

Reversible as long as you saved the old params value – and a backup is mandatory before any database change.

Sources & further reading

Analysis & changelog criticism – mySites.guru (Phil Taylor)Original report with technical details
JoomShaper (vendor)Get the update via the Joomla updater or your JoomShaper account

The official information from the respective vendor always takes precedence. This page neutrally summarises publicly available information.

Back to all vulnerabilities

Supporters

Supporters of this site

htprotect.org is a free, vendor-independent information service. It is supported by:

Host & community

FC-Hosting

Joomla host from Germany with active community support – discovered the first attack on the JCE vulnerability.

fc-hosting.de

Initiator & operator

Website-Bereinigung.de

Specialised in cleaning, maintaining and securing Joomla and WordPress websites.

website-bereinigung.de

Support this project

You run a hosting or Joomla service and would like to support htprotect.org – and be listed here as a supporter? Every contribution helps to warn and protect those affected faster.

Prefer to give privately, without a listing? A little something for the tip jar is just as welcome.

Support HTProtect now

Bauschild & Service

Manufactures and installs construction-site signs, hoardings and façade solutions – including design and 3D visualisation.

bauschildundservice.de

ITSPECIALISTA

IT Specialista

Professional IT support from Czechia – Windows management, domain administration and web hosting.

defendersoft.cz

onlineweg.de

Travel portal from Germany – package holidays, hotels and flights online, with personal travel-agency advice.

onlineweg.de

Criadero

Creative agency from Brandenburg – web design, print media, photography and 360° panoramas from a single source.

criadero.de

JahnEDV-Dienst GmbH

Jahn EDV-Dienst GmbH

IT service provider from Wächtersbach – Joomla websites, PC service, hardware and software.

jahnedv.de

IsariConsult

Information-security consulting from Berlin – security analyses, risk management and ISO 27001 for SMEs.

isari-consult.de