Joomla 6.1.2
The Joomla Project has released version 6.1.2, a security and bugfix update for the 6.x series, on July 7, 2026. This release addresses 12 security vulnerabilities and includes over 40 bug fixes, making it a recommended upgrade for all Joomla 6.x sites.
Security Fixes
Joomla 6.1.2 patches across several attack surfaces. The most critical fixes include incorrect access control in the com_media webservice endpoints and the com_contact vcf download handler. Multiple cross-site scripting (XSS) vectors have been resolved in com_templates, com_installer, MFA method management, modal return layouts, language overrides, and the generic image output layout. Access control issues in com_workflow, com_modules, com_privacy, and com_fields webservice endpoints have also been tightened.
Bug Fixes and Improvements
Beyond security, the release squad has addressed long-standing quality-of-life issues. Notable fixes include correcting a CodeMirror editor duplication bug, resolving an issue where database setup passwords with leading or trailing spaces caused installer failures, and fixing pagination breaks in modal views. The email sending test in contact forms has been added, and the Scheduled Tasks page now correctly shows a "Running Since" tooltip using the item's lock state rather than the last execution timestamp.
The Upgrade Path
Joomla 5.4.x users upgrading to 6.x can do so without a full migration — most J5 extensions that have removed deprecated code work natively in J6, and the rest can use the backward compatibility plugin. The Joomla Project will continue to support Joomla 5.4.x with bugfix patches until October 13, 2026, and security patches until October 12, 2027. Administrators are advised to test the upgrade on a staging site before deploying to production.
What's Next
According to the Joomla Project roadmap, 6.1.3 is scheduled for August 18, 2026, followed by 6.1.4 on September 29, 2026. The 6.2 minor release is in active development. Users can download Joomla 6.1.2 from the official downloads page, and existing sites can update through the built-in Joomla Update component.