Joomla 4.1.1 & 3.10.7 is now available. This is a security release for both the 4.x and the 3.x series of Joomla which addresses a few security vulnerabilities and contains various bug fixes and improvements
What's in 4.1.1?
Joomla 4.1.1 includes 8 security vulnerability fixes and addresses several bugs, including:
Security Issues Fixed
- [20220301] Low Severity - Moderate Impact - Zip Slip within the Tar extractor (affecting Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0) More information » (https://developer.joomla.org/security-centre/870-20220301-core-zip-slip-within-the-tar-extractor.html)
- [20220302] Low Severity - Low Impact - Path Disclosure within filesystem error messages (affecting Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0) More information » (https://developer.joomla.org/security-centre/871-20220302-core-path-disclosure-within-filesystem-error-messages.html)
- [20220303] Low Severity - High Impact - User row are not bound to a authentication mechanism (affecting Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0) More information » (https://developer.joomla.org/security-centre/872-20220303-core-user-row-are-not-bound-to-a-authentication-mechanism.html)
- [20220305] Low Severity - High Impact - Inadequate filtering on the selected Ids (affecting Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0) More information » (https://developer.joomla.org/security-centre/874-20220305-core-inadequate-filtering-on-the-selected-ids.html)
- [20220306] Low Severity - Low Impact - Inadequate validation of internal URLs (affecting Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0) More information » (https://developer.joomla.org/security-centre/875-20220306-core-inadequate-validation-of-internal-urls.html)
- [20220307] Low Severity - Moderate Impact - Variable Tampering on JInput $_REQUEST data (affecting Joomla! 4.0.0 through 4.1.0) More information » (https://developer.joomla.org/security-centre/876-20220307-core-variable-tampering-on-jinput-request-data.html)
- [20220308] Low Severity - Moderate Impact - Inadequate content filtering within the filter code (affecting Joomla! 4.0.0 through 4.1.0) More information » (https://developer.joomla.org/security-centre/877-20220308-core-inadequate-content-filtering-within-the-filter-code.html)
- [20220309] Low Severity - Moderate Impact - XSS attack vector through SVG (affecting Joomla! 4.0.0 through 4.1.0) More information » (https://developer.joomla.org/security-centre/878-20220309-core-xss-attack-vector-through-svg.html)
Bug fixes and Improvements
- Fix language strings behaviour in TinyMCE
- Fix switch for syntax highlighting in TinyMCE
- Show failed tasks in scheduler
- Correct usage of Jooa11y parameters
- Codemirror enhancements
- Several 8.x PHP fixes
Visit GitHub for the full list of bug fixes.
What’s in 3.10.7?
Joomla 3.10.7 includes 6 security vulnerability fixes and addresses several bugs, including:
Security Issues Fixed
- [20220301] Low Severity - Moderate Impact - Zip Slip within the Tar extractor (affecting Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0) More information » (https://developer.joomla.org/security-centre/870-20220301-core-zip-slip-within-the-tar-extractor.html)
- [20220302] Low Severity - Low Impact - Path Disclosure within filesystem error messages (affecting Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0) More information » (https://developer.joomla.org/security-centre/871-20220302-core-path-disclosure-within-filesystem-error-messages.html)
- [20220303] Low Severity - High Impact - User row are not bound to a authentication mechanism (affecting Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0) More information » (https://developer.joomla.org/security-centre/872-20220303-core-user-row-are-not-bound-to-a-authentication-mechanism.html)
- [20220304] Low Severity - Moderate Impact - Missing input validation within com_fields class inputs (affecting Joomla! 3.7.0 through 3.10.6) More information » (https://developer.joomla.org/security-centre/873-20220304-core-missing-input-validation-within-com-fields-class-inputs.html)
- [20220305] Low Severity - High Impact - Inadequate filtering on the selected Ids (affecting Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0) More information » (https://developer.joomla.org/security-centre/874-20220305-core-inadequate-filtering-on-the-selected-ids.html)
- [20220306] Low Severity - Low Impact - Inadequate validation of internal URLs (affecting Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0) More information » (https://developer.joomla.org/security-centre/875-20220306-core-inadequate-validation-of-internal-urls.html)
Bug fixes and Improvements
- Backport JQuery UI security patch for CVE-2021-41184 (#37308 (https://github.com/joomla/joomla-cms/pull/37308))
- Disable Google Fonts setting for 3.10.7+ new installations (#36888 (https://github.com/joomla/joomla-cms/pull/36888))
- [Regression] Fix updating redirect values unintentionally changed (#36951 (https://github.com/joomla/joomla-cms/pull/36951))
- Remove FLoC setting as it has been abandoned (#36861 (https://github.com/joomla/joomla-cms/pull/36861))
- E-Mail Cloak: TLDs long as 10 will no longer truncated until (#36986 (https://github.com/joomla/joomla-cms/pull/36986))
- Privacy Consent wording I agree vs I do not agree (#37181 (https://github.com/joomla/joomla-cms/pull/37181))
Visit GitHub for the full list of bug fixes.
Click here for full release information.