jDownloads 4.1.8 Stable security update for Joomla 5 and 6 is available.
This release fixes multiple security issues and improves file-management stability. We recommend updating existing installations promptly.
The security fixes address file and image handling, permission checks for referenced downloads, external download URL processing, and access to administrative functionality. Additional checks protect the renaming of files already assigned to a download.
Other fixes improve database compatibility during updates and installation information, and remove a PHP warning when deleting downloads. Problems with folder and file filtering in monitoring scans, identified during release testing, have also been corrected.
Before updating, take a complete backup of your website and database. Download the official installation package from jdownloads.com and install it using Joomla's extension installer. Afterwards, check the upload, editing and download workflows used by your website.
Please note two intentional restrictions: renaming an existing main or preview file must preserve its extension. To use a different file type, replace the file through the normal upload workflow. External downloads that require an HTTP redirect during server-side retrieval may be rejected for security reasons; use a direct file URL where possible. If your scan key may have been exposed, rotate it and update any scheduled URL-based scan jobs accordingly. The update does not automatically rotate existing keys.
We thank Łukasz Rybak and Fadilulah Ajeigbe for their security reports and collaboration, and David Jardin and the Joomla! Security Strike Team for their coordination.
