Joomla 6.1.3 security- and bugfix release

On Tuesday 18 August 2026, the Joomla! Project released Joomla 6.1.3, alongside Joomla 5.4.8. These are bug fix releases for the Joomla 5.x and 6.x series.

Security fixes in Joomla 6.1.3

• Access control improvements
  • Web service (API) endpoints now apply the same permission checks as the administrator interface, so users can no longer make changes through the API that they are blocked from making in the backend.
  • Strengthened permission checks when creating custom fields, so they can no longer be created for components the user has no access to.
  • Strengthened permission checks when creating categories, so they can no longer be created for components the user has no access to.
  • Corrected permission checks for batch copy actions, so items a user is not allowed to edit can no longer be copied.
• Preventing information from being exposed
  • Contact details belonging to contacts a visitor is not permitted to see are no longer included in the Schema.org structured data embedded in public pages.
• Protection against malicious code and files
  • Fixed incorrect escaping in Schema.org structured data output that could allow malicious scripts to be injected into website pages (cross-site scripting).
  • Added SHTML to the list of file types that cannot be uploaded. On servers configured to process these files, an uploaded SHTML file could otherwise lead to code being executed.
  • Download views now clean the values they place in response headers, preventing an attacker from manipulating those headers to disguise the type or name of a downloaded file.
• Login and account security
  • Fixed insufficient state checks in the login process that could allow multi-factor authentication (MFA) to be skipped.
• Cross-origin (CORS) requests
  • The list of allowed origins configured for cross-origin requests is now validated correctly, so requests from origins that were not approved are properly rejected.

Bug fixes in Joomla 6.1.3

• More reliable file and path validation
  Fixes an issue with file path validation. This prevents Joomla from incorrectly flagging valid files or locations as invalid.
• JavaScript libraries updated
  Updates various JavaScript components. This ensures an up-to-date technical foundation and better compatibility with modern browsers.
• Improvements from previous updates included
  Various improvements and fixes from the Joomla development process have been incorporated into Joomla 6.1.3, ensuring that the latest solutions are also available in this version.
• Translations updated
  Updates various language files and translations, ensuring that text in Joomla is displayed more accurately and consistently.
• Clean-up of TinyMCE files
  Corrects the handling of a TinyMCE editor language file during Joomla updates. This prevents files from being deleted incorrectly.
• General stability improvements
  Includes various minor technical fixes and maintenance updates that make Joomla 6.1 more stable, up-to-date and reliable.

The full list of changes can be found in the 6.1.3 milestone on GitHub.

Easy upgrade

Is your website already running on Joomla 5.4? If so, you can usually upgrade directly to Joomla 6.1.3 without a full migration. Thanks to the compatibility plugin, many existing extensions will continue to work as normal, meaning the transition is usually smooth.

However, it is important to prepare properly. You should therefore carry out the upgrade in a local test or staging environment first. This allows you to check in advance whether your template, extensions and customisations are compatible with Joomla 6.1.3, and helps you avoid any surprises or unnecessary downtime on your live website.

Need help with the upgrade or migration to Joomla 6.1.3? Please feel free to contact us!