5.2.5
| Security |
Fixed the CVE-2025-22213 vulnerability that allowed malicious executable PHP files to be uploaded through the Media Manager.
|
| Security |
Strengthened file upload validation for users with edit permissions in the Media Manager.
|
| Change |
Updated Joomla translations.
|
| Change |
Updated maximebf/debugbar to version 1.23.6.
|
| Change |
Updated the Cypress system test documentation.
|
| Fixed |
Added backup of the $_SERVER array through backupGlobals in unit tests.
|
| Fixed |
System tests no longer delete TUF metadata.
|
| Fixed |
Added a column alias to BannerTable and fixed a warning when saving a banner as a copy.
|
| Fixed |
Fixed a PHP warning caused by passing null to the trim() function.
|
| Fixed |
Added a border to the final Media Manager breadcrumb item.
|
| Fixed |
Disabled the backward compatibility plugin during system tests.
|
| Fixed |
Updated the Cypress menu system test.
|
| Fixed |
Fixed the Send Copy to Submitter feature in the Contacts component.
|
| Fixed |
Redesigned the carousel implementation to match its documentation.
|
| Fixed |
Fixed the frontend editing setting applied through the command-line interface after Joomla installation.
|
| Fixed |
Corrected the sudo command in the documentation.
|
| Fixed |
User sessions are now correctly cleaned after Cypress tests.
|
| Note |
Joomla 5.2.5 is a security and bug-fix release.
|
| Note |
Joomla 5.2.5 was released on 11 March 2025 together with Joomla 4.4.12.
|
| Note |
CVE-2025-22213 has critical potential impact, low severity and a low probability of exploitation.
|
| Note |
The vulnerability affects Joomla versions from 5.0.0 through 5.2.4.
|
| Note |
Exploiting the vulnerability requires a user account with edit permissions in the Media Manager.
|
| Note |
By default, this permission is granted to administrator user groups and frontend users with Editor permissions or higher.
|
| Note |
Successful exploitation could allow arbitrary PHP code to be executed on the server.
|
| Note |
A complete backup of the website files and database is recommended before updating.
|
| Note |
The update should be tested on a copy of the production website before deployment.
|
| Note |
When updating from a Joomla version earlier than 4.4, upgrade to Joomla 4.4 before updating to Joomla 5.
|