Skip to content

Joomla!

v5.4.7 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 19d Productivity & Wikis
โœ“ No known CVEs patched
Read the diff โ†’ Tool health โ†’ What is this tool? โ†’
This release patches 1 known CVE

Topics

cms content-management joomla multilingual-websites php php-cms
+1 more
website-builder

Summary

AI summary

Updates ๐Ÿ‘€ Release information, https://docs.joomla.org/How_to_determine_a_package_checksum, and zip across a mixed release.

Full changelog

๐Ÿ‘€ Release information

๐Ÿš€ Download information

[!NOTE]
Userfacing information about this Joomla! release can be found on the release page

๐Ÿ”ฅ Installation Packages

| New Joomla! Installations | SHA-256 Checksums |
|---------------------------|-------------------|
| ZIP Archive (.zip) | f7340a93d03b2b9d13191ab82cb2e08bfca882315998f55ce56a8ebb4309da8f |
| GNU Zip Archive (.tar.gz) | d989e8a315238784b8e4ca5eef0cad3e498e989cc0b9094d341c0d997ddb8729 |
| Zstandard Archive (.tar.zst) | f64840ec209a8031eecce36dde4580fa5dacc66436bba6ffdd7fcec7fffc5c27 |

Additional and a second source of checksums can be found at our official download page. If you need further information on how to validate a release package please visit our documentation.

โœ’๏ธ Upgrade Packages

[!IMPORTANT]
Don't update directly from a version lower than 4.4 it is important that you first update to 4.4 and then update to 5.x

| Update from a previous version | SHA-256 Checksums |
|--------------------------------|-------------------|
| ZIP Archive (.zip) | b2bea5d4a404cf0d48de7b5fa7e9cf7738b8a9af4ae520b8d71685e34bb0ebe0 |
| GNU Zip Archive (.tar.gz) | 2cf76ba3fcfdc1e619b9b7c25a26c364f7897d433ef8b9f43e4c8aabb66b4752 |
| Zstandard Archive (.tar.zst) | 7e2ca14b44f3250a73755be7896eb81c8db881ec531a70bf0249320f13ce156d |

Additional and a second source of checksums can be found at our official download page. If you need further information on how to validate a release package please visit our documentation.

๐Ÿงน What has been changed

  • [5.4] Update phpstan-baseline.neon 2026-05-26 by @richard67 in https://github.com/joomla/joomla-cms/pull/47836
  • [5.4] allow extension update from cli by @alikon in https://github.com/joomla/joomla-cms/pull/47203
  • [5.4] Load the mail template from the language of the mail template by @laoneo in https://github.com/joomla/joomla-cms/pull/47603
  • [5.4] Do not go to database setup in installer when password has spaces at beginning/end by @laoneo in https://github.com/joomla/joomla-cms/pull/47734
  • [5.4] Add system test for media manager search traverse issue by @laoneo in https://github.com/joomla/joomla-cms/pull/47837
  • [5.4] [webservices] Create a user access level via POST by @alikon in https://github.com/joomla/joomla-cms/pull/47748
  • [5.4] Fix Author Display Issue Using Article Setting by @CSGoat0 in https://github.com/joomla/joomla-cms/pull/47752
  • [5.4] npm update by @brianteeman in https://github.com/joomla/joomla-cms/pull/47771
  • [5.4] Activate filters in frontend only with filter-button by @chmst in https://github.com/joomla/joomla-cms/pull/47774
  • [5.4] Preserve zero select option text by @janschoenherr in https://github.com/joomla/joomla-cms/pull/47800
  • [5.4] Update typos GitHub action to v1.46.3 by @richard67 in https://github.com/joomla/joomla-cms/pull/47825
  • [5.4] Update actions-setup-mysql GitHub action to v1.51.0 by @richard67 in https://github.com/joomla/joomla-cms/pull/47827
  • [5.4] Regression fix for security fix in 5.4.6 and 6.1.1 by @HLeithner in https://github.com/joomla/joomla-cms/pull/47852
  • [5.4] Fix Modal Pagination Breaks Navigation by @CSGoat0 in https://github.com/joomla/joomla-cms/pull/47855
  • [5.4][webservices] PATCH user access level without rules by @alikon in https://github.com/joomla/joomla-cms/pull/47751
  • [5.4] Composer update symfony/yaml to v6.4.41 to fix 3 security vulnerabilities by @richard67 in https://github.com/joomla/joomla-cms/pull/47847
  • [5.4] Update github-script GitHub action to v9.0.0 by @richard67 in https://github.com/joomla/joomla-cms/pull/47830
  • [5.4] Update setup-php GitHub action to v2.37.1 by @richard67 in https://github.com/joomla/joomla-cms/pull/47826
  • [5.4] Cache fido metadata in build directory and preserve on build by @HLeithner in https://github.com/joomla/joomla-cms/pull/47882
  • [5.4] Joomla Alert Success by @brianteeman in https://github.com/joomla/joomla-cms/pull/47865
  • [5.4] Compile the manifest path from extension root by @laoneo in https://github.com/joomla/joomla-cms/pull/47637
  • [5.4] Add drone fido/composer/npm cache by @Hackwar in https://github.com/joomla/joomla-cms/pull/47895
  • [5.4] fix CodeMirror editor duplication by @adarshdubey03 in https://github.com/joomla/joomla-cms/pull/47548
  • [5.4] Fix aria-expanded check by @janschoenherr in https://github.com/joomla/joomla-cms/pull/47483
  • [5.4] add email sending test for contact form by @alikon in https://github.com/joomla/joomla-cms/pull/47869
  • [5.4] Reorder and update Text::script() calls for media field labels by @brianteeman in https://github.com/joomla/joomla-cms/pull/47896
  • [5.4] Reorder and update Text::script() calls for joomlaupdate by @brianteeman in https://github.com/joomla/joomla-cms/pull/47917
  • [5.4] Fix doc block for input type by @laoneo in https://github.com/joomla/joomla-cms/pull/47931
  • [5.4] POST com_contact form with webservices and custom reply enabled by @alikon in https://github.com/joomla/joomla-cms/pull/47819
  • [5.4] Always use a new installer instance on discover install by @laoneo in https://github.com/joomla/joomla-cms/pull/47964
  • [5.4] Fix potential issue with update multiple extensions by @joomdonation in https://github.com/joomla/joomla-cms/pull/47978
  • [5.4] Cookie authentication: load language file so log message is translated by @tecpromotion in https://github.com/joomla/joomla-cms/pull/47985
  • [5.4] Cookie authentication: fix username placeholder in failed-login log message by @tecpromotion in https://github.com/joomla/joomla-cms/pull/47986
  • [5.4] Use the correct function to get the message from an exception by @laoneo in https://github.com/joomla/joomla-cms/pull/47972
  • [5.4] [AI] Fix the Indexer Debugger constructor and show error passing no or invalid id by @MacJoom in https://github.com/joomla/joomla-cms/pull/47916
  • [5.4] contact serializer and newsfeed serializer by @sinahaghparast in https://github.com/joomla/joomla-cms/pull/44914
  • [5.4] Add integration tests for CLI config:get command by @alikon in https://github.com/joomla/joomla-cms/pull/47818
  • [5.4] com_users unable to filter by unactivated users state by @alikon in https://github.com/joomla/joomla-cms/pull/47993
  • [5.4] Add system test for console command scheduler by @alikon in https://github.com/joomla/joomla-cms/pull/47763
  • [5.4] Use item->locked instead of item->last_execution in "Running Since" tooltip on Scheduled Tasks page by @hiteshm0 in https://github.com/joomla/joomla-cms/pull/47951
  • [5.4] Composer updates 2026-06-24 by @richard67 in https://github.com/joomla/joomla-cms/pull/48018
  • [5.4] NPM updates 2026-06-25 by @richard67 in https://github.com/joomla/joomla-cms/pull/48024
  • [5.4] Adds code style fixes and phpstan update by @laoneo in https://github.com/joomla/joomla-cms/pull/47936

Full Changelog: https://github.com/joomla/joomla-cms/compare/5.4.6...5.4.7

:technologist: Test contributions

Thank you to all the testers who help us maintain high quality standards and deliver a robust product.

@adarshdubey03 (2), @alikon (5), @brianteeman (10), @ChristineWk (1), @CSGoat0 (5), @exlemor (5), @joomdonation (2), @krishnagandhicode (3), @laoneo (1), @MacJoom (2), @michaelmaass (1), @muhme (4), @QuyTon (11), @richard67 (2), @roland-d (1), @Sulpher (1), @ThomasFinnern (5)

Security Fixes

  • Composer update symfony/yaml to v6.4.41 fixes three security vulnerabilities (CVE IDs not listed in source)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Joomla!

Get notified when new releases ship.

Sign up free

About Joomla!

Advanced Content Management System (CMS).

All releases โ†’

Related context

Related tools

Beta — feedback welcome: [email protected]