Joomla 6.1.3 & 5.4.8: Security & Bugfix Release

Security and bugfix releases for Joomla versions 6.1.3 and 5.4.8 are now available.

These releases continue Joomla's high standards in accessible web design, embodying the values of inclusiveness, simplicity, and security into an even more powerful open-source web platform.

Security Fixes

In this release, developers addressed several vulnerabilities that could have impacted site security:

• ACL check when displaying link to user edit form: Fixed an issue where the link to edit a user profile could be displayed to users without the appropriate permissions.
• Path traversal in com_templates: Added a path traversal check in the template management component, preventing access to files outside of allowed directories.

Bug Fixes and Improvements

The following bug fixes are included in Joomla! 6.1.3 and Joomla! 5.4.8 (all 5.4 bug fixes are also up-merged into 6.1):

• Fixed: editing a menu item now returns to the list view with original filters preserved.
• Implemented date and time validation on input change to improve data validation.
• Improved error messages for issues with update servers.
• Fixed the data-nested='true' attribute for nested components (categories, menu items, modules).
• Fixed Global Check-in, which was incorrectly handling rows with checked_out=0.
• Fixed article options being ignored when viewing an article.
• Prevented division by zero error in ListModel when list.limit is set to 0.
• Updated the joomla/filesystem library from 3.2.0 to 3.3.0.
• Removed obsolete Bosnian language files for TinyMCE.
• Fixed duplicate "No results" message in installed languages.
• Fixed action logging for user block/unblock — the event is now recorded only once.
• Removed File Patcher leftovers from the 5.4.7 hotfix during core updates.
• Fixed division by zero error in Subform fields.
• Standardized the memory_table_limit parameter in Smart Search.
• Fixed a typo in the Awesomplete library usage example.
• Fixed indentation in the TreeSelect element.
• Fixed days of the week normalization for correct display.
• Fixed the display of the "Site Offline" page.

Where to Download Joomla 6.1.3 & 5.4.8?

Download the latest Joomla version here.

Upgrading to Joomla 6.1.3

Upgrading from Joomla 5.4.x to Joomla 6 is an upgrade, not a migration. Joomla 5 extensions that have removed all deprecated code will work in Joomla 6. Most other extensions will work with the Behaviour 6 — Backward Compatibility plugin enabled.

It is recommended to test the upgrade on a copy of your production site before applying it. 

Please note: Joomla 5.4.x will receive bugfix support until October 13, 2026 and security patches until October 12, 2027, so you have time for a planned upgrade.

If you have any questions or encounter difficulties with the update, contact us for assistance!