I am a total beginner in Joomla. I found that the security patch for the following vulnerability was fixed in 3.9.9:

Filter attribute in subform fields allows remote code execution

But I am not finding the code changes in Joomla that fixes this vulnerability. Anyone know if it is possible to check the code?

At the Joomla website the CVE Number is: TBA.


1 Answer 1


Changes for security patches are normally hidden further down in the commit history or sometimes in the actual release commit to throw people off.

In this case, the security patch is in the release commit, which you can see here:


Normally I wouldn't post information on security patches like this, but seeing as Joomla 3.9.9 was released about a month ago, it should be fine.

  • How can we check if these changes are compatible with the older Joomla versions?
    – IBrito
    Aug 3, 2019 at 13:07
  • @IngriddBrito It was a patch release. No B/C breaks
    – Lodder
    Aug 3, 2019 at 14:14
  • Well, no b/c breaks with the 3.9 tree, is what that means.Upgrading to it from, say, 3.0, would be a different story.
    – Arlen
    Aug 7, 2019 at 19:26
  • @IngriddBrito The best way to check is to have a copy of your site running on a local system. Upgrade it first, and test. Joomla project tries to test on everything, but there's always the chance that your setup is outside the testing boundaries. if that's not possible for you, backup your site before any upgrade. Backups are Good Things, and never a waste, even if it turns out you Didn't Need It This Time. My personal choice is Akeeba; it can be configured to take a backup as part of the upgrade process. (I am not connected with nor compensated by Akeeba for saying that.)
    – Arlen
    Aug 7, 2019 at 19:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.