JoomGallery 4.4.0 Feature/Security Release
This update patches two critical security vulnerabilities that have existed since the beginning of JoomGallery 4.x. So we strongly recommend to update!
In addition, two long-awaited new features have been added:
- Gallery view with search bar and filters
- Task Manager for administrative tasks in the backend
About the Security Update
On 3 August 2026, security researcher Toan Le responsibly disclosed two security vulnerabilities in JoomGallery to us. The vulnerabilities are tracked as CVE-2026-66916 and CVE-2026-66917.
Both vulnerabilities have been fixed in JoomGallery 4.4.0. We recommend that all administrators running an affected installation update to version 4.4.0 or later.
How high is the risk to my gallery?
We classify both vulnerabilities as medium risk. Certain conditions must be met for them to be exploited. Installations where logged-in users are permitted to edit JoomGallery content in the frontend are particularly relevant.
If the gallery is managed exclusively by trusted administrators in the backend and other users do not have the corresponding permissions to edit JoomGallery content, the practical risk posed by these two vulnerabilities is significantly lower.
CVE-2026-66916 – Unauthorised Access to Protected Content
The first vulnerability makes it possible to access information about images and categories even though they are intended to be protected. This particularly affects password-protected content. As a result, information may be disclosed and, under certain circumstances, protected content or images may be accessed or downloaded without authorisation.
CVE-2026-66917 – Manipulation of Other Users' Content and JavaScript Injection
The second vulnerability concerns the editing of content by logged-in users. Under certain conditions, a user with editing permissions can change the ownership of images or categories belonging to other users. This may give the user additional permissions for content that they do not originally own. This might allow the new owner to change unintended content. Additionally, it is possible in certain frontend views to inject manipulated JavaScript code into content. This code may then be executed in other users' browsers when they view the affected content.
Please note that it is very important that your JoomGallery permissions are configured properly to suit your use case of the gallery. You can find instructions on how to do this here: Understanding Permissions (ACL)
Summary for Administrators
- Affected: JoomGallery versions 4.0.0 to 4.3.x
- Fixed in: JoomGallery 4.4.0 and later
- CVE: CVE-2026-66916, CVE-2026-66917
- Risk level: Medium
- Attack requirement: Logged-in user with the relevant editing permissions
- Potential impact: Access to protected content, manipulation of other users' content and, in certain cases, JavaScript injection
- System compromise: Not possible
- Recommended action: Update to JoomGallery 4.4.0 or later and then check the editable content. It is also strongly recommended that you check your own template overrides and apply the changes from the update to them as well.
New Features
Task Manager
The new Task Manager reliably handles resource-intensive operations, such as regenerating image files, in the background. Tasks can be monitored, paused, resumed and scheduled, with detailed progress and error information.
Gallery View with Search
The redesigned gallery view offers improved filtering options and configurable search providers. You can choose between the built-in keyword search and Joomla's Smart Search. The new Finder plugin indexes JoomGallery images, enabling flexible search results sorted by relevance.
Further New Features and Improvements
- More information in category views
The number of images contained in each category is now displayed directly alongside the category. The usability and appearance of the category view have also been improved. - More control over image sorting
Administrators can specify additional image sorting options directly in the settings of a menu item. - New module positions
Additional module positions provide greater flexibility when designing and extending JoomGallery views. - Image view counters
Image views can now be recorded and displayed, making it easier to see how popular individual images are. - Optimised page titles
Image and category titles are now included in the HTML page title, improving orientation, browser tabs and search engine visibility. - More reliable metadata
Issues affecting the processing of image metadata have been fixed.
See GitHub for the Complete Changelog
Changelog on GitHub
Download Now
Download JoomGallery 4.4.0 directly HERE.
Language packs are available.
Migration from JoomGallery 3.x is supported. You can find all the information you need about migration in the migration guide.