News
Joomla 6.1.3 and 5.4.8 address core security issues
Joomla administrators should update to 6.1.3 or 5.4.8, which address ten Core security issues alongside routine fixes and improvements across the two supported series.
The security work covers several areas that affect site administration and extension-facing functionality. The listed issues include response header injection in download views, improper CORS origin validation, inconsistent or improper ACL checks in webservice and batch-copy operations, XSS through schema.org outputs, an MFA authentication bypass, schema.org contact-data injection, and unrestricted SHTML uploads.
- All ten security entries are attributed to
Coreand are identified by the project as20260801through20260810. - The maintenance changes also cover menu editing, date and time validation, update-server error messages, nested components, global check-in, article options, division-by-zero errors, language handling, path traversal checks in
com_templates, Smart Search, and site-offline behavior.
Administrators can obtain installation and update packages from the Joomla 6 downloads page and the Joomla 5.4.8 downloads page. The project recommends testing upgrades on a copy of the production site first. Joomla 5.4.x receives bugfix patches until 13 October 2026 and security patches until 12 October 2027.
For developers planning the move from Joomla 5.4.x to 6.x, the project says this is an upgrade rather than a migration. Extension compatibility depends on removing deprecated code or using the Behaviour 6 - Backward Compatibility Plugin, so extensions should be checked before deployment.
Published by the Joomla Project.