Content management and web applications

Joomla core, September 2026 security release (CVE-2026-90915, CVE-2026-92222 and others)

Joomla core check

Joomla 5.4.9 and 6.1.4, released on 29 September 2026, fix 16 core security issues (CVE-2026-90906 to CVE-2026-92232). The Joomla Security Strike Team rates two of them High and thirteen Moderate.

The release also fixes issues that the sources used here describe without an identifier, including unauthorized account creation while registration is disabled. The table lists only the identifiers those sources name.

How the script reads an install

libraries/src/Version.php holds the version as constants (MAJOR_VERSION, MINOR_VERSION, PATCH_VERSION). The script also reads one file the fix changed, libraries/src/Cache/Storage/FileStorage.php: the cache-purge fix adds Path::check($dir, $this->_root). That signature confirms the High cache flaw and catches a partial update, a fixed version number on a file that still has the old code, or the reverse. The other fifteen fixes are judged by the version.

Quick start

curl -fLO https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main/joomla/joomla-check.sh
less joomla-check.sh
chmod +x joomla-check.sh
./joomla-check.sh check

By default it searches /var/www /srv /home /opt /usr/share. Pass directories to narrow it. Everything is read-only.

Commands

Commands that change the host need root. Run them with sudo from an admin account, not from a root login, so the change is recorded against a person. The script stops and prints the exact command if you forget:

sudo ./joomla-check.sh mitigate --allow 203.0.113.0/24 --dry-run
sudo ./joomla-check.sh mitigate --allow 203.0.113.0/24
sudo ./joomla-check.sh rollback

Mitigation: restrict the administrator path

Most of these flaws need a logged-in account, so limiting who can reach the login reduces the exposure. Run ./joomla-check.sh mitigate --allow 203.0.113.0/24 --dry-run, then again without --dry-run and with --reload. Verified on nginx 1.24: from an address outside the list, /administrator/index.php, /administrator/ and /ADMINISTRATOR/index.php get 403. From loopback the request still reaches the PHP handler. /index.php and static files are unaffected; rollback restores the original behavior. On Apache 2.4.58 the same restriction answered 403 from a non-allowed address and 200 from loopback on every virtual host.

If a proxy or CDN sits in front of the server, the address the web server sees is the proxy's, so the rule would lock everyone out or let everyone in. Make sure real client addresses reach the web server first, and keep a second way in, such as a second session or console access. This is PrivacySafe's recommendation. The fix is to update to 5.4.9 or 6.1.4 or newer.

Update

Update from the administrator (System, Update, Joomla) or with the update package. Joomla documents no workaround. Until then the project suggests limiting who holds Manager or higher and restricting the administrator path by address, since most of these flaws need a logged-in account. That is not Joomla's guidance.

Sources

• Joomla security center
• mySites.guru: Joomla 5.4.9 and 6.1.4 security release
• Joomla 5.4.9 release

Before you run it

• The fix. Update to 5.4.9 or later in 5.x, or to 6.1.4 or later. Sites on 3.x, 4.x or 5.0 to 5.3 move to 5.4.9 or 6.1.4 or later: those branches are past security support.
• Two flaws are rated High. CVE-2026-90915 (arbitrary directory deletion through the cache purge action) and CVE-2026-92222 (server-side request forgery, which needs a Manager account or above). The SSRF flaw reaches back to 3.0.0.
• The release is broader than the CVE list. 5.4.9 and 6.1.4 fix 16 core issues. The script names the ones in its README, and the same update fixes the rest.
• There is no hunt. No indicators of exploitation have been published.
• It also checks running docker and podman containers, unless you name a directory or set SCAN_CONTAINERS=0. The check finds installs inside running docker and podman containers by their marker file, copies only the files it reads into a private temporary directory, and judges them like a host install. A path shown as .../docker_NAME_PATH is the PATH inside the container NAME. It never runs anything in a container beyond find and a file copy, never copies .env or wp-config.php, never keeps a staged symlink, and is skipped when you name directories yourself.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.

Edit this page on Codeberg