Ce mail provient de l'extérieur, restons vigilants ==================================================================== CERT-Renater Note d'Information No. 2026/VULN735 _____________________________________________________________________ DATE : 08/07/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Joomla versions prior to 6.1.2, 5.4.7. ==================================================================== https://www.joomla.org/announcements/release-news/5955-joomla-6-1-2-5-4-7-security-bugfix-release.html _____________________________________________________________________ The Joomla! Project is pleased to announce the release of Joomla 6.1.2 and Joomla 5.4.7. These are security & bugfix releases for the Joomla 5.x and 6.x series. These releases continue Joomla’s high standards in accessible web design, highlighting Joomla's values of inclusiveness, simplicity and security into an even more powerful open-source web platform. Security fixes [20260701] - Core - Incorrect Access Control in com_media webservice endpoints [20260702] - Core - Incorrect Access Control in com_contact vcf download [20260703] - Core - XSS in MFA method management [20260704] - Core - XSS in com_templates [20260705] - Core - XSS in various modalreturn layouts [20260706] - Core - XSS in com_installer [20260707] - Core - XSS in the generic image output layout [20260708] - Core - XSS through language overrides [20260709] - Core - Incorrect Access Control in com_workflow [20260710] - Core - Incorrect Access Control in com_modules [20260711] - Core - Incorrect Access Control in com_privacy webservice endpoints [20260712] - Core - Incorrect Access Control in com_fields webservice endpoints Bug fixes and improvements The following bug fixes are included in Joomla! 6.1.2 and Joomla! 5.4.7 (all 5.4 bug fixes are also up-merged into 6.1): #44914: [5.4] contact serializer and newsfeed serializer by @sinahaghparast #47203: [5.4] allow extension update from cli by @alikon #47483: [5.4] Fix aria-expanded check by @janschoenherr #47548: [5.4] fix CodeMirror editor duplication by @adarshdubey03 #47603: [5.4] Load the mail template from the language of the mail template by @laoneo #47637: [5.4] Compile the manifest path from extension root by @laoneo #47734: [5.4] Do not go to database setup in installer when password has spaces at beginning/end by @laoneo #47748: [5.4] [webservices] Create a user access level via POST by @alikon #47751: [5.4] [webservices] PATCH user access level without rules by @alikon #47752: [5.4] Fix Author Display Issue Using Article Setting by @CSGoat0 #47774: [5.4] Activate filters in frontend only with filter-button by @chmst #47791: [6.1] Update docs about branches after 6.1.0 stable by @heelc29 #47792: [6.1] README delete heavy development note by @heelc29 #47800: [5.4] Preserve zero select option text by @janschoenherr #47804: [6.1] [AI] Fix Accessiblemedia subform values for non-image media types by @tecpromotion #47819: [5.4] POST com_contact form with webservices and custom reply enabled by @alikon #47831: [6.1] Remove obsolete exclusion for tinymce/langs from typos.toml by @richard67 #47852: [5.4] Regression fix for security fix in 5.4.6 and 6.1.1 by @HLeithner #47855: [5.4] Fix Modal Pagination Breaks Navigation by @CSGoat0 #47865: [5.4] Joomla Alert Success by @brianteeman #47869: [5.4] add email sending test for contact form by @alikon #47882: [5.4] Cache fido metadata in build directory and preserve on build by @HLeithner #47896: [5.4] Reorder and update Text::script() calls for media field labels by @brianteeman #47916: [5.4] [AI] Fix the Indexer Debugger constructor and show error passing no or invalid id by @MacJoom #47917: [5.4] Reorder and update Text::script() calls for joomlaupdate by @brianteeman #47920: [6.1] Disable flaky view transitions in system tests by @laoneo #47931: [5.4] Fix doc block for input type by @laoneo #47951: [5.4] Use item->locked instead of item->last_execution in "Running Since" tooltip on Scheduled Tasks page by @hiteshm0 #47964: [5.4] Always use a new installer instance on discover install by @laoneo #47972: [5.4] Use the correct function to get the message from an exception by @laoneo #47978: [5.4] Fix potential issue with update multiple extensions by @joomdonation #47985: [5.4] Cookie authentication: load language file so log message is translated by @tecpromotion #47986: [5.4] Cookie authentication: fix username placeholder in failed-login log message by @tecpromotion #47993: [5.4] com_users unable to filter by unactivated users state by @alikon #47996: [6.1] [AI] Make CSS url() versioning resilient to unparseable vendor CSS by @tecpromotion #48038: [6.1] [AI] Fix extension/update upload failing after joomla/filesystem 4.2.0 by @tecpromotion The full list of Pull Requests for Joomla! 6.1.2 on GitHub is available here: https://github.com/joomla/joomla-cms/milestone/164?closed=1 The full list of Pull Requests for Joomla! 5.4.7 on GitHub is available here: https://github.com/joomla/joomla-cms/milestone/161?closed=1 Where can I download Joomla 6.1.2? You can find all Joomla 6 downloads through the official downloads page at: https://downloads.joomla.org/cms/joomla6/ New Installations New installation instructions and technical requirements Install 6.1.2 Upgrade Upgrade 6.1.2 Would you like to make a tour of Joomla 6 without having to install it? We have a solution for you: Install Joomla 6 at launch.joomla.org and update it (automatically). Where can I download Joomla 5.4.7? Packages in different formats can be downloaded as full packages for installing new Joomla Sites or as update packages for updating an existing Joomla site from: https://downloads.joomla.org/cms/joomla5/5-4-7 How can I upgrade my site to Joomla 6.1.2? Good news for Joomla 5.4.x to 6.x, it’s an upgrade, not a migration. Why? Two main reasons: Joomla 5 (J5) extensions that have removed all deprecations of code and are using up-to date Joomla code, will work in Joomla 6 (J6) Most others will work with the new Behaviour 6 - Backward Compatibility Plugin enabled The full details are found here: https://guide.joomla.org/user-manual/migration/joomla-5-to-6-planning-and-upgrade-step-by-step Note: we advise you to first test the upgrade on a copy of your production site. You may also wonder if you have to upgrade ASAP. We’ll support Joomla 5.4.x until 13 October 2026 with bugfix patches and until 12 October 2027 with security patches. So your site is not at risk if you don’t upgrade now. And don’t forget that some of your extensions may not be yet ready for Joomla 6 (even though most developers have done a great job offering a Joomla 6 test version for a while. You can filter by version in the Joomla Extensions Directory so you can see which are ready for J6 and which are J6 ready with the b/c plugin enabled. Who is Joomla! for? Web agencies, large and small companies, online shops, bloggers, communities, and all kinds of organizations (for example, NGOs, schools, charities and governments) all use Joomla as their preferred CMS. Joomla is written by committed volunteers. Many of those volunteers use it in their everyday web design, building and hosting. So, unlike many other systems, Joomla is built by those using it on a daily basis. That is reflected in its secure, robust nature. Is there help for extension developers with Joomla 6? Yes, a growing manual is aimed at those who code and maintain their extensions. The manual can be found at https://manual.joomla.org/migrations/54-60/ and is a growing work to help developers get ahead of any changes. How can you help develop Joomla? There are a variety of ways in which you can get actively involved with Joomla. It doesn't matter if you are a coder, an integrator, or a user of Joomla. You can join the community on Mattermost and look through the teams to join, or if you are ready, you can jump right into the Joomla! Bug Squad. The Joomla Bug Squad and the CMS Release Team are some of the most active teams in the CMS development process and are always looking for people (not just developers) who can help with sorting bug reports, coding patches and testing solutions. It is a great way to increase your working knowledge of the Joomla code base and also a great way to meet new people from all around the world. You can also help Joomla development by thanking those involved in the many areas of the process. The Project also wants to thank all the contributors who have taken the time to prepare and submit work to be included in the Joomla CMS and Framework. Where can I find documentation about Joomla 6? The primary source for user documentation is guide.joomla.org. Developer documentation can be at https://manual.joomla.org. The documentation team is always looking for extra hands to help improve documentation. If you like to contribute please have a look at the Jobs To-Do and contact the documentation team on their mattermost channel (PD Documentation) Related information If you are an extension developer, please make sure you subscribe to the extension developer channel https://joomlacommunity.cloud.mattermost.com/main/channels/extension-development-room Where you can join the community of extension developers. Filing bugs and issues General developer mailing list Joomla developer network A Huge Thank You to Our Volunteers! Joomla 6.1.2 results from thousands of hours of work by dozens of volunteers. A big thank you to everyone who contributed to Joomla 6.1.2! Full details are on GitHub. Joomla 5.4.7 is the product of countless hours of dedication from our volunteer community. Our sincere thanks go to everyone who helped make Joomla 5.4.7 possible. You can find the complete list of changes on GitHub. Thank you all. Translations Dutch: Veiligheids en bug-fix release Joomla 6.1.2 en 5.4.7 French : Joomla 6.1.2 et 5.4.7 : correction de bugs et sécurité German: Joomla! 6.1.2 und Joomla! 5.4.7 als Sicherheits- und Bugfix-Release veröffentlicht Italian: Joomla!® 6.1.2 e 5.4.7 - Rilascio di sicurezza e correzione bug Russian: Вышли релизы безопасности Joomla 6.1.2 и Joomla 5.4.7 Turkish: Joomla 6.1.2 ve 5.4.7 Güvenlik ve Hata Düzeltme Sürümü Yayınlandı! ======================================================== + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + ========================================================