Joomla fixes module access-control flaw
Joomla CMS sites running 4.0.0-5.4.6 or 6.0.0-6.1.1 should be upgraded to 5.4.7 or 6.1.2 to address a Moderate-severity access-control issue.
Security
Security releases, vulnerabilities and hardening for Joomla.
Joomla workflow access flaw fixed in version 6.1.2
Administrators running Joomla! CMS 6.0.0-6.1.1 should upgrade to 6.1.2 to address a Moderate Incorrect Access Control vulnerability in com_workflow, tracked as…
Joomla language overrides expose sites to moderate XSS
Joomla! CMS sites running versions 3.0.0-5.4.5 or 6.0.0-6.1.1 are affected by a Moderate XSS vulnerability in language overrides; administrators should upgrade…
Joomla generic image layout exposed to XSS
Administrators running Joomla! CMS 4.0.0-5.4.5 or 6.0.0-6.1.1 should upgrade to 5.4.7 or 6.1.2 to address a Moderate-severity XSS vulnerability in the generic…
Joomla com_installer XSS fixed in 5.4.7 and 6.1.2
Joomla administrators running affected CMS releases should upgrade to 5.4.7 or 6.1.2, which fix a Moderate XSS vulnerability in com_installer.
Joomla fixes XSS in modalreturn layouts
Joomla administrators should upgrade to version 5.4.7 or 6.1.2 to address a Moderate XSS vulnerability in modalreturn layouts, tracked as CVE-2026-48951.
Joomla fixes XSS in com_templates file management view
Joomla installations in the affected 4.x, 5.x and 6.x ranges should be upgraded to 5.4.7 or 6.1.2 to address a Moderate XSS vulnerability in com_templates…
Joomla MFA XSS fixed in 5.4.7 and 6.1.2
Joomla! CMS versions 4.2.0-5.4.5 and 6.0.0-6.1.1 are affected by an XSS vulnerability in the MFA management views. The Joomla project rates it Moderate…
Joomla fixes access control flaw in contact vCard downloads
Administrators running Joomla! CMS versions 3.0.0-5.4.5 or 6.0.0-6.1.1 should upgrade to 5.4.7 or 6.1.2 to address a Low-severity Incorrect Access Control…
SP Page Builder flaw exploited to create Joomla admins
A critical SP Page Builder vulnerability is being exploited against Joomla sites, allowing unauthenticated attackers to upload PHP files and create hidden…
Joomla Framework XSS fixed in cleanAttributes filtering
Joomla! CMS installations running 3.0.0-5.4.5 or 6.0.0-6.1.0 are affected by a Moderate XSS issue in the Framework; upgrade to 5.4.6 or 6.1.1.
Joomla fixes XSS in checkAttribute filtering
Joomla CMS sites running 3.0.0-5.4.5 or 6.0.0-6.1.0 should be upgraded to 5.4.6 or 6.1.1 to address a Moderate-severity XSS vulnerability in the Framewok…