Helix Ultimate Joomla 3 Security Fixes v1.0.2

Helix Ultimate J3 Security Fixes 1.0.2 — August 27, 2026

Security & Hardening Backports

• Security: Added binary raster decoding and MIME content verification (Helper::isValidImageContent) to block file upload bypasses.
• Security: Hardened media path resolution with null-byte detection and canonical realpath root confinement (Helper::resolveMediaPath).
• Security: Enforced item-level and menu-level asset authorization checks (com_menus.menu.<menutype>) in Response::saveMegaMenuSettings.
• Security: Escaped and sanitized Mega Menu layout JSON settings in layout container and field controls against XSS injection.
• Security: Added strict heading tag allowlists (h1–h6, div, span, p), CSS hex color validation, and quoted background URL escaping in Page Title feature.
• Security: Enforced object-level article edit authorization (canEditArticle) during image and content attribute operations.
• Security: Restricted Live Preview and Coming Soon bypass to authenticated users with template edit permissions.
• Security: Hardened template style installer updates with primary key ID scoping and cleanup of obsolete vendor files.
• Security: Resolved Joomla update site mapping via verified installed extension IDs on joomshaper.com.