Joomla 5 Update Package - Version 5.4.7

[20260701] Fixed incorrect access control in com_media web service endpoints.

[20260702] Fixed incorrect access control when downloading VCF files from com_contact.

[20260703] Fixed an XSS vulnerability in MFA method management.

[20260704] Fixed an XSS vulnerability in com_templates.

[20260705] Fixed XSS vulnerabilities in various modalreturn layouts.

[20260706] Fixed an XSS vulnerability in com_installer.

[20260707] Fixed an XSS vulnerability in the generic image output layout.

[20260708] Fixed an XSS vulnerability involving language overrides.

[20260709] Fixed incorrect access control in com_workflow.

[20260710] Fixed incorrect access control in com_modules.

[20260711] Fixed incorrect access control in com_privacy web service endpoints.

[20260712] Fixed incorrect access control in com_fields web service endpoints.

#47836 — Updated the phpstan-baseline.neon file.

#47203 — Added support for updating extensions from the command-line interface.

#47603 — Mail templates are now loaded using the language assigned to the template.

#47734 — The installer no longer proceeds to database setup when the password contains leading or trailing spaces.

#47837 — Added a system test for the Media Manager search path traversal issue.

#47748 — Added support for creating a user access level through a POST web service request.

#47752 — Fixed author display when using article-specific settings.

#47771 — Updated NPM dependencies.

#47774 — Front-end filters are now activated only when the filter button is available.

#47800 — Preserved the text of the zero-value option in selection fields.

#47825 — Updated the Typos GitHub Action to version 1.46.3.

#47827 — Updated the actions-setup-mysql GitHub Action to version 1.51.0.

#47852 — Fixed a regression introduced by the security fix in Joomla 5.4.6 and 6.1.1.

#47855 — Fixed modal pagination breaking navigation.

#47751 — Added support for updating a user access level without supplying rules through a PATCH request.

#47847 — Updated symfony/yaml to version 6.4.41 to fix three security vulnerabilities.

#47830 — Updated the github-script GitHub Action to version 9.0.0.

#47826 — Updated the setup-php GitHub Action to version 2.37.1.

#47882 — FIDO metadata is now cached in the build directory and preserved during builds.

#47865 — Fixed the Joomla success alert.

#47637 — The manifest path is now compiled from the extension root directory.

#47895 — Added FIDO, Composer and NPM caching to the Drone configuration.

#47548 — Fixed CodeMirror editor duplication.

#47483 — Fixed the aria-expanded attribute check.

#47869 — Added an email-sending test for the contact form.

#47896 — Reordered and updated Text::script() calls for media field labels.

#47917 — Reordered and updated Text::script() calls in the Joomla Update component.

#47931 — Fixed the documentation block for the input type.

#47819 — Fixed submitting the com_contact form through web services when custom reply is enabled.

#47964 — A new installer instance is now always used when installing discovered extensions.

#47978 — Fixed a potential issue when updating multiple extensions.

#47985 — Cookie authentication now loads the language file so that log messages can be translated.

#47986 — Fixed the username placeholder in failed cookie-login log messages.

#47972 — The correct function is now used to retrieve a message from an exception.

#47916 — Fixed the Indexer Debugger constructor and added an error message when no ID or an invalid ID is supplied.

#44914 — Fixed the contact and news feed serializers.

#47818 — Added integration tests for the config:get CLI command.

#47993 — Fixed filtering by unactivated user status in com_users.

#47763 — Added a system test for the Scheduled Tasks console command.

#47951 — The “Running Since” tooltip on the Scheduled Tasks page now uses the locked property instead of last_execution.

#48018 — Updated Composer dependencies.

#48024 — Updated NPM dependencies.

#47936 — Added code style fixes and updated the PHPStan configuration.

Joomla 5.4.7 is a security and bugfix release.

Installing Joomla 5.4.7 as soon as possible is strongly recommended.

Joomla 5.4.7 was released together with Joomla 6.1.2.

Joomla 5.4.7 has a known issue where article-specific parameters may be ignored when an article is displayed through a category layout or a single-article menu item.

An installable Joomla_5_4_7_and_6_1_2_ArticleModel_Hotfix1.zip package was released as a temporary fix.

The permanent fix for the known issue was included in Joomla 5.4.8.

Creating a website backup and checking the compatibility of installed extensions and templates is recommended before updating.