Joomla 6.1.4 security- and bugfix release

On Tuesday 29 September 2026, the Joomla! Project released Joomla 6.1.4. This is a bugfix and maintenance release for the Joomla 6.1 series.

Security fixes for Joomla 6.1.4

Joomla 6.1.4 includes 16 security fixes. These address several vulnerabilities in the Joomla core, including cross-site scripting (XSS), access control issues, server-side request forgery (SSRF) and an MFA authentication bypass.

• Cross-site scripting (XSS)
  Several XSS vulnerabilities have been fixed in Joomla, including issues in HTML links, media layouts, HTML mail templates, toolbar links and module lists.
• Access control (ACL) improvements
  Multiple issues with insufficient permission checks have been resolved. These affected webservice endpoints, content history, tagged items, workflow stage changes and several webservice editing tasks.
• Unauthorized account creation
  A vulnerability in the user profile controller that could allow unauthorized user account creation has been fixed.
• MFA authentication bypass
  Joomla fixes an issue where remember-me cookies could potentially be used to bypass Multi-factor Authentication (MFA).
• Server-side request forgery (SSRF)
  Several potential SSRF vectors in Joomla core extensions have been addressed.
• Input filtering improvements
  Two vulnerabilities that could bypass Joomla's XSS filtering have been fixed, involving HTML5 entity decoding and whitespace characters in HTML data URIs.
• Cache directory deletion
  A vulnerability in the cache purge functionality that could allow arbitrary directory deletion has been resolved.

Because Joomla 6.1.4 contains multiple security fixes, we recommend updating existing Joomla 6.1 websites as soon as possible.

Bug fixes in Joomla 6.1.4

• Improved Proof-of-Work CAPTCHA
  The Proof-of-Work CAPTCHA introduced in Joomla 6.1 has been improved. An unnecessary CSRF token check has been removed and empty user answers are now handled correctly. This makes the CAPTCHA validation more reliable.
• Category month filter fixed
  Fixes an error when filtering category lists by month. The filter now correctly handles the selected date and displays the expected content.
• Improved multilingual editing
  Joomla now retrieves the correct language when editing content in the frontend. This fixes an issue that could occur when editing items on multilingual websites.
• TinyMCE language file clean-up
  Corrects the handling of Welsh TinyMCE language files during Joomla updates. This prevents language files from being incorrectly removed.
• Obsolete code removed
  An unused Adapter class has been removed from Joomla. Removing obsolete code keeps the Joomla codebase cleaner and easier to maintain.
• Composer dependencies updated
  Several PHP dependencies managed through Composer have been updated. This keeps Joomla's underlying libraries current and improves compatibility and maintainability.
• JavaScript dependencies updated
  Updates to JavaScript and NPM dependencies from the Joomla development branch have been incorporated into Joomla 6.1.4, keeping the frontend and administrator interface on an up-to-date technical foundation.
• Translations updated
  Various Joomla language files and translations have been updated, improving the accuracy and consistency of texts throughout the CMS.
• General stability improvements
  Several fixes and improvements from Joomla development have been merged into the 6.1 branch. Together, these changes make Joomla 6.1 more stable and reliable.

The full list of changes can be found in the 6.1.4 milestone on GitHub.

Easy upgrade

Is your website already running on Joomla 6.1? Updating to Joomla 6.1.4 is a regular maintenance update and should normally be straightforward.

Is your website still running on Joomla 5.4? You can usually upgrade directly to Joomla 6.1.4 without a full migration. Thanks to the compatibility plugin, many existing extensions will continue to work as normal.

However, it is still important to prepare properly. We recommend carrying out the upgrade in a local test or staging environment first. This allows you to check whether your template, extensions and customisations are compatible with Joomla 6.1.4 before updating your live website.

Need help with the upgrade or migration to Joomla 6.1.4? Please feel free to contact us!