psf-joomla-check(8)

Script: /opt/psf-security-patches/joomla/joomla-check.sh. Tool page: Joomla. Source. With the package installed: man psf-joomla-check.

Joomla core, September 2026 security release (16 issues): checker with mitigation  (v1)
CVE-2026-90915 and CVE-2026-92222 (High), CVE-2026-92227 (MFA bypass) and others

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

Joomla 5.4.9 and 6.1.4, released 29 September 2026, fix 16 core security issues
(CVE-2026-90906 to CVE-2026-92232). The Joomla Security Strike Team rates two High:

  CVE-2026-90915  Arbitrary directory deletion. The cache purge action (System, Clear
                  Cache) did not confine the cache group name, so a path traversal in
                  the file-based cache could delete any directory the web server can
                  write to. Affects 4.0.0 to 5.4.8 and 6.0.0 to 6.1.3.
  CVE-2026-92222  Server-side request forgery through URL fields (feed and request URLs)
                  in several core extensions. Affects 3.0.0 and later; needs a Manager
                  account or above.

Others in the same release, as named in the advisories: CVE-2026-92227 (a multi-factor
authentication bypass through remember-me cookies issued too early; needs the password
first), CVE-2026-90916 (improper access checks in the content history comparison view),
cross-site scripting in HTMLHelper::link and the link toolbar (CVE-2026-90906,
CVE-2026-92224), tagged items (CVE-2026-90917) and two InputFilter bypasses
(CVE-2026-92231, CVE-2026-92232), and access-control fixes in the Joomla API
(CVE-2026-90913, CVE-2026-92226).

  Affected: Joomla 6.0.0 to 6.1.3, and 4.0.0 to 5.4.8 (the SSRF flaw reaches back to
            3.0.0, one XSS flaw to 1.5.0).
  Fixed:    5.4.9 and 6.1.4. Sites on 3.x or 4.x or on 5.0 to 5.3 are past
            security support, so the fix is to move to 5.4.9 or later in 5.x, or to
            6.1.4 or later.

How this script reads an install. Version.php holds the version as constants
(MAJOR_VERSION, MINOR_VERSION, PATCH_VERSION). It also reads one file the fix changed,
libraries/src/Cache/Storage/FileStorage.php: the cache-purge fix adds
Path::check($dir, $this->_root). That single signature confirms the High cache flaw and
catches a partial update; the other fifteen fixes are judged by the version.

"check" is read-only; "mitigate" and "rollback" are the only commands that change anything.

Usage:
  ./joomla-check.sh [command] [DIR ...]
  check (default)  find Joomla by libraries/src/Version.php (default /var/www /srv /home
                   /opt /usr/share). Exit 0 = nothing exposed, 1 = exposed or unclear.
  mitigate --allow LIST [options]   (root) changes the host. PrivacySafe protection:
                   restricts /administrator to the
                   addresses or CIDRs in LIST (comma separated) plus loopback; every
                   other address gets a 403. Only when an exposed Joomla is found
                   (--force overrides). --allow is mandatory, because without it
                   everyone would be locked out. Options:
                     --web auto|apache|nginx  which web server (default auto: every one found)
                     --dir DIR                where to look for Joomla (repeat)
                     --server-name NAME       nginx: only the server block that lists NAME
                     --dry-run                show the changes, change nothing
                     --reload                 graceful reload afterwards (systemd)
                     --force                  apply even if no exposed Joomla is found
                   Apache: psf-joomla-admin-allow.conf with "Require ip", checked with a
                   configtest. nginx: a geo and map block included right after "http {",
                   and an include as the first line of every PHP-serving server block,
                   checked with nginx -t. If the web server rejects the result everything
                   is undone at once. A proxy or CDN in front hides client addresses:
                   the rule then sees only the proxy. Keep a second way in.
  rollback [--dry-run] [--reload]   remove what mitigate added and restore the files it edited.
  version          print the script version.
Containers: with no directory argument the check also copies the files it reads from running
docker and podman containers (SCAN_CONTAINERS=1, the default; 0 skips them) and judges them like
host installs. The copies are temporary: a path shown as .../docker_NAME_PATH is the PATH inside
the container NAME.
     PSF_LOCK_WAIT    seconds a run that changes the host waits for another one that is already
                      changing it (default 30), then stops with exit 2; the lock is STATE_DIR/.lock

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.