Table of contents

  1. Security Fixes
    1. High-Severity Vulnerabilities
    2. Moderate-Severity Vulnerabilities
    3. Low-Severity Vulnerability
  2. Which Joomla Versions Are at Risk?
  3. Bug Fixes and Improvements
  4. Template Manager Issue Fixed
  5. Where Can I Download Joomla 6.1.4 and 5.4.9?
  6. Upgrade Path Requirements
  7. Upgrading from Joomla 5.4 to Joomla 6.1.4
  8. What Should You Check After Updating?

On September 29, 2026, Joomla 6.1.4 and Joomla 5.4.9 were released. These are major security and bugfix updates for the currently supported Joomla 5.x and Joomla 6.x series.

The new versions address a total of 16 security vulnerabilities, including arbitrary directory deletion, Server-Side Request Forgery (SSRF), multi-factor authentication bypass, unauthorized user account creation when registration is disabled, several XSS vulnerabilities, and incorrect access control checks.

Two vulnerabilities were rated High severity, thirteen were rated Moderate, and one was rated Low. In addition to the security fixes, the developers resolved issues in the Template Manager, Media Manager, Smart Search, custom fields, tags, multilingual associations, and other parts of Joomla.

Important:
Update Joomla 5 websites to version 5.4.9 and Joomla 6 websites to version 6.1.4. Before updating, make sure you create a complete backup of the website files and database.

Security Fixes

Joomla 6.1.4 and Joomla 5.4.9 address the following security vulnerabilities:

High-Severity Vulnerabilities

  • CVE-2026-90915 — arbitrary directory deletion: Insufficient validation of the cache group name allowed path traversal during file-based cache purging. A user with the necessary administrator permissions could delete an arbitrary directory writable by the web server. The vulnerability affects Joomla 4.0.0–5.4.8 and 6.0.0–6.1.3.
  • CVE-2026-92222 — Server-Side Request Forgery (SSRF): URLs used by several core extensions for server-side requests were not validated strictly enough. This could allow an authenticated user to force the server to connect to internal or external resources. The vulnerability affects Joomla starting from version 3.0.0.

Moderate-Severity Vulnerabilities

  • CVE-2026-90906 — XSS in HTMLHelper::link: Insufficient escaping in the link generation method could result in injected JavaScript being executed. The vulnerability had been present since Joomla 1.5.0.
  • CVE-2026-90907 — account creation when registration is disabled: The profile.save controller did not check whether the user was authenticated. An anonymous visitor could create a Guest-level account even on a website where user registration was disabled.
  • CVE-2026-90913 — improper ACL checks in access level API endpoints: Insufficient permission checks allowed web service users to perform unauthorized access level modification operations.
  • CVE-2026-90914 — XSS in audio and video layouts: The generic media output layouts did not sufficiently escape their data.
  • CVE-2026-90917 — disclosure of articles from restricted categories: Improper permission checks allowed unauthorized visitors to view tagged content items from categories they were not permitted to access.
  • CVE-2026-90918 — XSS in HTML email templates: Insufficient escaping in the mail template system introduced XSS vectors across several core extensions.
  • CVE-2026-92223 — workflow stage changes without the required permission: A user could change the workflow stage of an article they were not authorized to access.
  • CVE-2026-92224 — XSS in the link toolbar layout: Insufficient data sanitization could allow JavaScript execution when toolbar buttons and links were generated.
  • CVE-2026-92225 — XSS in the module list: Insufficient escaping in the module list could allow malicious JavaScript code to be injected.
  • CVE-2026-92226 — insufficient permission checks in web service editing tasks: Some API requests checked general permissions but did not always verify whether the user was authorized to modify the specific item.
  • CVE-2026-92227 — multi-factor authentication bypass: In a specific scenario involving the “Remember Me” feature, a user who knew the correct password could later gain access through a cookie without completing the second-factor verification.
  • CVE-2026-92231 — XSS filter bypass through HTML5 entities: Differences between the way Joomla’s filter and web browsers processed HTML entities made it possible to bypass some InputFilter rules.
  • CVE-2026-92232 — XSS filter bypass through whitespace characters: Specially crafted whitespace characters in HTML links using the data: scheme could be used to bypass filtering.

Low-Severity Vulnerability

  • CVE-2026-90916 — improper permission checks when comparing versions: In the content history comparison view, a user with content editing permissions could access the contents of other items that should not have been available to them.

User Registration
CVE-2026-90907 did not grant administrative privileges to the newly created account. By default, the user was placed in the Guest group and could not log in. However, the account was created even when registration was disabled, could reserve a particular username or email address, and triggered plugins associated with user creation.

Multi-Factor Authentication Bypass
To exploit CVE-2026-92227, an attacker must know the correct username and password. The issue affected frontend login using the “Remember Me” feature. The Joomla administrator login form does not provide this option.

Which Joomla Versions Are at Risk?

The exact affected range depends on the individual vulnerability, but the following websites should be updated:

  • all websites running Joomla 5.4.8 or earlier;
  • all websites running Joomla 6.1.3 or earlier;
  • websites running Joomla 4 that have not yet been upgraded to a supported branch;
  • websites running the outdated Joomla 3 series, because some vulnerabilities have been present since Joomla 1.5.0 or 3.0.0.

Joomla 3 No Longer Receives Security Fixes
Several vulnerabilities addressed by this release also affect Joomla 3, but no official patch has been released for that branch. Owners of Joomla 3 websites should plan an upgrade to a currently supported Joomla version as soon as possible.

Bug Fixes and Improvements

Joomla 6.1.4 and Joomla 5.4.9 include the following bug fixes. All fixes from the Joomla 5.4 branch have also been merged into Joomla 6.1:

  • Fixed the generation of absolute logo image URLs in Schema.org structured data.
  • Fixed the handling of an empty publish_up date value.
  • Fixed an error when unsetting a custom field variable.
  • The option and title attributes are now correctly respected in alternative layout XML files.
  • Fixed URL parameter handling in Tags menu items.
  • The Media Manager image editor can now re-save images using their original filenames containing non-ASCII characters.
  • Restored the “Read More” link in the Articles module when the intro text is truncated by the introtext_limit setting.
  • Fixed dropdown interface elements being disabled before they had finished closing.
  • Added escaping of formula characters when exporting banner tracking data to CSV.
  • TOTP codes are now verified using the secure hash_equals comparison function.
  • Fixed an open_basedir restriction error in the Image List custom field.
  • Added safe handling of the php_uname function on servers where it is disabled.
  • Fixed Smart Search indexing with PostgreSQL.
  • Fixed category associations being lost when a translated category was unpublished.
  • Prevented duplicate records from being created in the #__ucm_content table whenever an article containing tags was saved.
  • Added a flag to the update system for identifying security updates.
  • The filter button is now displayed correctly in the category article list.
  • Fixed invalid jobLocationType values in JobPosting structured data.
  • Fixed the uniqueness check for tag aliases.
  • Added language retrieval to the edit_container.php layout in Joomla 6.1.
  • Fixed errors in the Template Manager.
  • Fixed a warning displayed when attempting to access missing template source files.
  • Improved keyboard navigation in the Calendar field.
  • Removed an unnecessary CSRF token check from POW CAPTCHA in Joomla 6.1.
  • The Media Manager no longer allows the same item to be selected twice, which previously could cause a 404 error during deletion.
  • Fixed the template override count.
  • Removed duplicate options from custom fields.
  • Fixed category list filtering by month in Joomla 6.1.
  • The result of preg_match in the isImage method is now explicitly converted to a Boolean value.
  • Fixed the full-text caption in the legacy Newsflash module.
  • Fixed the InstallerScriptTrait::allowDowngrades parameter in Joomla 6.1.
  • Fixed an archive extraction error in the Template Manager.
  • Added translations for buttons in the TinyMCE editor builder.
  • Fixed errors in the component layout selection field, ComponentlayoutField.
  • Fixed clearing the context selector in Workflows.

Template Manager Issue Fixed

Joomla 5.4.8 and Joomla 6.1.3 introduced a regression in the Template Manager. When creating a new folder or working with template overrides, Joomla could display the error Snooping out of bounds @.

This issue has been fixed in Joomla 5.4.9 and Joomla 6.1.4. After updating, creating folders, editing template files, and managing overrides should work correctly again.

Where Can I Download Joomla 6.1.4 and 5.4.9?

You can download the latest Joomla version from the download section of our website or from the official Joomla Project website.

For an existing website, we recommend using Joomla’s built-in update component:

  1. Create a complete backup of the website files and database.
  2. Go to System → Update → Joomla in the administrator panel.
  3. Make sure Joomla offers version 5.4.9 or 6.1.4, depending on the branch currently installed.
  4. Start the update and wait for it to complete.
  5. After updating, clear the Joomla cache and test the main website pages and administrator panel.

Upgrade Path Requirements

To update directly to Joomla 5.4.9, the website must already be running Joomla 4.4 or one of the Joomla 5 versions. If Joomla 4.3 or an earlier version is installed, the website must first be updated to Joomla 4.4.

Before upgrading to Joomla 6.1.4, the website must first be running Joomla 5.4. The recommended upgrade paths are therefore:

  • Joomla 4.3 or earlier → Joomla 4.4 → Joomla 5.4.9;
  • Joomla 5.0–5.3 → Joomla 5.4.9 → Joomla 6.1.4;
  • Joomla 5.4.x → Joomla 5.4.9 or Joomla 6.1.4;
  • Joomla 6.0–6.1.3 → Joomla 6.1.4.

Database Change
The update adds a security column to the #__updates table. This column is used to identify security updates. For this reason, creating a database backup before installation is especially important.

Upgrading from Joomla 5.4 to Joomla 6.1.4

Moving from Joomla 5.4.x to Joomla 6 is an upgrade rather than a migration. Joomla 5 extensions that no longer use deprecated code and rely on the current Joomla API should work with Joomla 6.

Most other extensions may continue to work when the Behaviour 6 — Backward Compatibility plugin is enabled. Nevertheless, you should check the compatibility of your template, components, modules, and plugins before upgrading.

We recommend testing the upgrade on a copy of the production website first and updating the live website only after the test has been completed successfully.

Joomla 5.4.x will continue receiving bug fixes until October 13, 2026, and security fixes until October 12, 2027. Therefore, you can plan your migration to Joomla 6, but Joomla 5 websites should be updated to Joomla 5.4.9 immediately.

What Should You Check After Updating?

  • frontend and administrator login;
  • multi-factor authentication and the “Remember Me” feature;
  • article creation, editing, and saving;
  • the Media Manager and image editing;
  • the Template Manager and the creation of template overrides;
  • Smart Search and content indexing;
  • custom fields, tags, and multilingual associations;
  • forms, email templates, and message delivery;
  • third-party components, modules, and plugins.

Submit a Request Services

Terms used:

Frontend, Media Manager, Override, Smart search, HTML, JavaScript, XML, XSS, Authentication, Backup, Cookie, Menu