Joomla patches ten core flaws in CMS 5.4.9 and 6.1.4

Joomla released CMS 5.4.9 and 6.1.4 on 25 September 2026, fixing ten core flaws spanning XSS, ACL, path traversal, and SSRF.

On 25 September 2026 the Joomla Security Centre published ten core advisories, all fixed in CMS 5.4.9 and 6.1.4. The set includes XSS in HTMLHelper::link (CVE-2026-90906), generic audio and video media layouts (CVE-2026-90914), HTML mail templates (CVE-2026-90918), and the link toolbar (CVE-2026-92224), plus InputFilter bypasses via an HTML5 entity-decoding mismatch (CVE-2026-92231) and whitespace in HTML data URIs (CVE-2026-92232). Access-control flaws allow unauthorized mutations on access-level webservice endpoints (CVE-2026-90913, impact high) and viewing tagged items in inaccessible categories (CVE-2026-90917). A cache-purge path traversal (CVE-2026-90915) can delete arbitrary directories, and improperly validated URLs enable SSRF in core extensions (CVE-2026-92222). Most issues affect 4.0.0–5.4.8 and 6.0.0–6.1.3, while the HTMLHelper and both InputFilter bugs also reach 1.5.0; sources disagree on SSRF, listing both 4.0.0–5.4.8 and 6.0.0–6.1.3 and an advisory line of 3.0.0–5.4.8. None of the advisories report exploitation in the wild.