Joomla 6 Full Package - Version 6.1.2

[20260701] Fixed incorrect access control in com_media web service endpoints.

[20260702] Fixed incorrect access control when downloading VCF files from com_contact.

[20260703] Fixed an XSS vulnerability in MFA method management.

[20260704] Fixed an XSS vulnerability in com_templates.

[20260705] Fixed XSS vulnerabilities in various modalreturn layouts.

[20260706] Fixed an XSS vulnerability in com_installer.

[20260707] Fixed an XSS vulnerability in the generic image output layout.

[20260708] Fixed an XSS vulnerability involving language overrides.

[20260709] Fixed incorrect access control in com_workflow.

[20260710] Fixed incorrect access control in com_modules.

[20260711] Fixed incorrect access control in com_privacy web service endpoints.

[20260712] Fixed incorrect access control in com_fields web service endpoints.

#44914 — Fixed the contact and news feed serializers.

#47203 — Added support for updating extensions from the command-line interface.

#47483 — Fixed the aria-expanded attribute check.

#47548 — Fixed CodeMirror editor duplication.

#47603 — Mail templates are now loaded using the language assigned to the template.

#47637 — The manifest path is now compiled from the extension root directory.

#47734 — The installer no longer proceeds to database setup when the password contains leading or trailing spaces.

#47748 — Added support for creating a user access level through a POST web service request.

#47751 — Added support for updating a user access level without supplying rules through a PATCH request.

#47752 — Fixed author display when using article-specific settings.

#47774 — Front-end filters are now activated only when the filter button is available.

#47791 — Updated branch documentation following the stable release of Joomla 6.1.0.

#47792 — Removed the obsolete heavy development warning from the README file.

#47800 — Preserved the text of the zero-value option in selection fields.

#47804 — Fixed Accessible Media subform values for non-image media types.

#47819 — Fixed submitting the com_contact form through web services when custom reply is enabled.

#47831 — Removed the obsolete TinyMCE language files exclusion from typos.toml.

#47852 — Fixed a regression introduced by the security fix in Joomla 5.4.6 and 6.1.1.

#47855 — Fixed modal pagination breaking navigation.

#47865 — Fixed the Joomla success alert.

#47869 — Added an email-sending test for the contact form.

#47882 — FIDO metadata is now cached in the build directory and preserved during builds.

#47896 — Reordered and updated Text::script() calls for media field labels.

#47916 — Fixed the Indexer Debugger constructor and added an error message when no ID or an invalid ID is supplied.

#47917 — Reordered and updated Text::script() calls in the Joomla Update component.

#47920 — Disabled unreliable view transitions in system tests.

#47931 — Fixed the documentation block for the input type.

#47951 — The “Running Since” tooltip on the Scheduled Tasks page now uses the locked property.

#47964 — A new installer instance is now always used when installing discovered extensions.

#47972 — The correct function is now used to retrieve a message from an exception.

#47978 — Fixed a potential issue when updating multiple extensions.

#47985 — Cookie authentication now loads the language file so that log messages can be translated.

#47986 — Fixed the username placeholder in failed cookie-login log messages.

#47993 — Fixed filtering by unactivated user status in com_users.

#47996 — Made CSS URL versioning resilient to unparseable third-party CSS files.

#48038 — Fixed extension and update package uploads failing after updating joomla/filesystem to version 4.2.0.

Joomla 6.1.2 is a security release. Installing the update as soon as possible is strongly recommended.

All bug fixes included in Joomla 5.4.7 have also been merged into Joomla 6.1.2.

Joomla 6.1.2 has a known issue where article-specific parameters may be ignored when an article is displayed through a category layout or a single-article menu item.

A separate Joomla_5_4_7_and_6_1_2_ArticleModel_Hotfix1.zip package was released to correct the known issue.