How to Schedule Articles and Manage Publishing Dates in Joomla 6
Beginner
β± 6 min
News
Joomla 6.1.3 & 5.4.8 Security & Bugfix Release: What Changed and How to Update
β‘ Quick Answer
Joomla released version 6.1.3 and 5.4.8 on August 18, 2026, as a combined security and bugfix update. It patches 10 core security issues (ACL bypass, CORS validation, an MFA authentication bypass, and more) plus 19 bug fixes. Update as soon as you can test it on a staging copy of your site.
The Joomla! Project has released Joomla 6.1.3 and Joomla 5.4.8, a coordinated security and bugfix release for both the 5.x and 6.x branches. This post breaks down what got patched, what changed, and what you need to do about it.
What's in this release?
Joomla 6.1.3 and 5.4.8 are maintenance releases, not feature updates. Every 5.4 bug fix has also been merged up into the 6.1 branch, so both versions receive the same corrections. There is no forced database migration involved β this is a routine update.
Security fixes
Ten core vulnerabilities were addressed in this release, covering access control, CORS handling, multi-factor authentication, and file uploads. None of the public advisories include a CVSS severity rating from Joomla directly, so check each advisory link for scope and affected versions before prioritizing your update window.
| Advisory | Issue |
|---|---|
| 20260801 | Response header injection in download views |
| 20260802 | Improper CORS origin validation |
| 20260803 | Inconsistent ACL checks for mutating webservice endpoints |
| 20260804 | Improper ACL checks for custom fields webservice endpoints |
| 20260805 | Improper ACL checks for category webservice endpoints |
| 20260806 | XSS through schema.org outputs |
| 20260807 | MFA authentication bypass |
| 20260808 | Improper ACL checks for batch copy actions |
| 20260809 | Improper ACL checks when injecting schema.org contact data |
| 20260810 | Unrestricted uploads of SHTML files |
β οΈ Why the MFA bypass matters most
Of the ten fixes, the MFA authentication bypass (20260807) and the unrestricted SHTML upload issue (20260810) are the ones most worth prioritizing β they touch login security and arbitrary file execution respectively. If your site uses two-factor authentication or accepts file uploads from non-admin users, update sooner rather than later.
Bug fixes and improvements
Alongside the security patches, 19 pull requests were merged covering ACL display checks, menu item editing, date/time input validation, update server error messages, nested component filters, Global Check-in behavior, article view options, a division-by-zero fix in list models and subforms, path traversal checks in com_templates, Smart Search memory limits, and several UI/translation fixes.
| Area | What changed |
|---|---|
| Access control (ACL) | Checks added before showing user-edit links and for batch/nested actions |
| Forms & validation | Date/time input validation on change; fixed division-by-zero in subforms and list models |
| Security hardening | Path traversal checks added in com_templates |
| Search | Smart Search memory table limit standardized |
| UI / misc | Menu item filter retention, treeselect indentation, language list duplicate message, and several translation/typo fixes |
For the complete, unabridged list of pull requests, see the official milestones: Joomla 6.1.3 on GitHub and Joomla 5.4.8 on GitHub.
How to download and upgrade
| Version | Download |
|---|---|
| Joomla 6.1.3 (new install) | Full package (zip) |
| Joomla 6.1.3 (upgrade) | Update package |
| Joomla 5.4.8 | Full & update packages |
Going from 5.4.x to 6.x is officially an upgrade, not a migration. Extensions that have already removed deprecated code will keep working in Joomla 6, and most others should still work thanks to the new Behaviour 6 β Backward Compatibility plugin. Test on a staging copy first before touching your production site.
π Support timeline for Joomla 5.4.x
Joomla 5.4.x keeps receiving bugfix patches until October 13, 2026, and security patches until October 12, 2027. You are not at immediate risk if you don't upgrade to 6.x right away β but you should still apply this 5.4.8 security patch to whichever branch you're running.
β Frequently Asked Questions
Is Joomla 6.1.3 a security release?
Yes. It patches 10 core vulnerabilities, including an MFA authentication bypass and several ACL/access-control issues, alongside 19 general bug fixes.
Do I have to upgrade from Joomla 5.4 to 6.1 right now?
No. Joomla 5.4.x still gets bugfix support until October 13, 2026, and security support until October 12, 2027. But you should still install the 5.4.8 patch if you're staying on 5.x.
Will my Joomla 5 extensions work on Joomla 6?
Most will. Extensions with deprecated code already removed work natively; others typically work with the Behaviour 6 β Backward Compatibility plugin enabled. Check the Joomla Extensions Directory to filter by J6-ready status.
Where do I download Joomla 6.1.3 or 5.4.8?
Official downloads are at downloads.joomla.org β full packages for new installs, update packages for existing sites on either the 6.x or 5.x branch.
Is upgrading from 5.4 to 6.1 a migration or an upgrade?
It's classified as an upgrade, not a migration, since Joomla 6 maintains backward compatibility through the new Behaviour 6 plugin for most extensions.
What's the most important fix in this release?
The MFA authentication bypass (advisory 20260807) and the unrestricted SHTML upload issue (20260810) are the two most worth prioritizing, since they affect login security and file-upload safety directly.
β
Last verified on Joomla 6.1.3 / 5.4.8 β August 2026
Thanh Le
Joomla Specialist & Technical Writer
Thanh Le is a Joomla expert and technical writer at Jlvextension.com, known for creating in-depth tutorials, extension reviews, and optimization guides. His work focuses on helping developers and webs
