Joomla 5.4.8 security- and bugfix release

On Tuesday 18 August 2026, the Joomla! Project released Joomla 5.4.8, alongside Joomla 6.1.3.  These are bug fix releases for the Joomla 5.x and 6.x series.

Security fixes in Joomla 5.4.8

• Access control improvements
  • Web service (API) endpoints now apply the same permission checks as the administrator interface, so users can no longer make changes through the API that they are blocked from making in the backend.
  • Strengthened permission checks when creating custom fields, so they can no longer be created for components the user has no access to.
  • Strengthened permission checks when creating categories, so they can no longer be created for components the user has no access to.
  • Corrected permission checks for batch copy actions, so items a user is not allowed to edit can no longer be copied.
• Preventing information from being exposed
  • Contact details belonging to contacts a visitor is not permitted to see are no longer included in the Schema.org structured data embedded in public pages.
• Protection against malicious code and files
  • Fixed incorrect escaping in Schema.org structured data output that could allow malicious scripts to be injected into website pages (cross-site scripting).
  • Added SHTML to the list of file types that cannot be uploaded. On servers configured to process these files, an uploaded SHTML file could otherwise lead to code being executed.
  • Download views now clean the values they place in response headers, preventing an attacker from manipulating those headers to disguise the type or name of a downloaded file.
• Login and account security
  • Fixed insufficient state checks in the login process that could allow multi-factor authentication (MFA) to be skipped.
• Cross-origin (CORS) requests
  • The list of allowed origins configured for cross-origin requests is now validated correctly, so requests from origins that were not approved are properly rejected.

Bug fixes in Joomla 5.4.8

• Article settings now work correctly again
  Resolves an issue where certain article settings were not always applied. As a result, articles are now displayed according to the configured options.
• Improvements to menu items
  After editing a menu item, Joomla now correctly returns to the overview, whilst retaining any previously set filters.
• Improved handling of categories, menus and modules
  Corrects the processing of components with a hierarchical structure, such as categories, menu items and modules.
• Improved global check-in
  Prevents Joomla from incorrectly identifying components as checked out. This makes the global check-in function more reliable.
• Improved access control in user management
  Joomla checks more thoroughly whether a user has permission to edit other users before displaying an edit link.
• Improvements to forms and lists
  Resolves errors that could occur in specific situations involving empty lists or forms. This prevents unexpected error messages.
• Improvements to Smart Search
  Optimises a technical setting of the search index, making the built-in search function work more consistently and reliably.
• Improved security for template files
  Adds additional checks when working with template files to prevent unauthorised access to files outside the permitted folders.
• Clearer error messages during updates
  Provides better information when Joomla is unable to connect to an update server. This makes it easier to determine why an update is not available.
• Cleaner Joomla updates
  Removes leftover files from a previous Joomla 5.4.7 patch, ensuring future updates are carried out from a cleaner base.
• Updated translations
  Updates various language files and translations, ensuring that text in Joomla is displayed more accurately and consistently.
• General stability improvements
  Also includes various minor bug fixes, tests and technical improvements that make Joomla 5.4 more stable and reliable.

Please note: do not upgrade directly to Joomla 5.x from a version older than 4.4. First upgrade to Joomla 4.4 and only then to Joomla 5.x.

The full list of changes can be found in the 5.4.8 milestone on GitHub.

Upgrading to Joomla 6

The main aim of the Joomla 5.4.x releases is to prepare website owners for a smooth transition from Joomla 5.x to Joomla 6.x. We build all new websites directly on Joomla 6.x. We upgrade existing websites as soon as the hosting environment – including the PHP and database versions – and all installed extensions are fully compatible with Joomla 6.

Need help updating or migrating your website to Joomla 6? Please feel free to contact us!