Joomla 3.9.16 is now available. This is a security release for the 3.x series of Joomla which addresses six security vulnerabilities and contains over 20 bug fixes and improvements.
Don't forget to backup your site first
What's in 3.9.16?
Joomla 3.9.16 includes 6 security vulnerability fixes and addresses several bugs, including:
Security Issues Fixed
- Low Priority - Core - SQL injection in Featured Articles menu parameters (affecting Joomla 1.7.0 through 3.9.15) More information »
- Low Priority - Core - CSRF in com_templates image actions (affecting Joomla 3.2.0 through 3.9.15) More information »
- Low Priority - Core - XSS in Protostar and Beez3 (affecting Joomla 3.0.0 through 3.9.15) More information »
- Low Priority - Core - Incorrect Access Control in com_templates (affecting Joomla 2.5.0 through 3.9.15) More information »
- Low Priority - Core - Identifier collisions in com_users (affecting Joomla 3.0.0 through 3.9.15) More information »
- Low Priority - Core - Incorrect Access Control in com_fields SQL field (affecting Joomla 3.7.0 through 3.9.15) More information »
Bug fixes and Improvements
- Link rel attributes: ‘noopener’ attributes #28005, ‘sponsored’ and ‘ugc’ attributes #28055
- Fields - Imagelist: Correct the display of the folder structure #16708
- Popular Tags Module fix #27745
- User - Contact Creator plugin: catid fixed #27949
Visit GitHub for the full list of bug fixes.
Download
New Installations
Download Joomla 3.9.16English (UK), 3.9.16 Full Package
Upgrade Packages
Upgrade PackagesJoomla 3 upgrade packages
Note: Please read the update instructions before updating.
Remember… Please clear your browser's cache after updating.
Found a bug? Report it on the Joomla Issue Tracker.
Questions? See the documentation wiki for FAQ’s regarding the 3.9.16 release.
A Huge Thank You to Our Volunteers!
A big thank you goes out to everyone that contributed to the 3.9 releases!
Make the next Joomla release even better
Download the upcoming releases from the nightly build page (for testing purposes only - do not use on production sites).
Want an even easier option? Get yourself over to launch.joomla.org - where you can also test Joomla 4.0 with just one click - no testing environment needed, nothing to install or set up (at all).