ClamAV filter
A Jahia module that scans uploaded files against a ClamAV antivirus daemon and blocks any upload containing detected malware.
Screenshots
How to install
Requirements
- Jahia 8.2.1 or later
- A running ClamAV daemon reachable from the Jahia server
graphql-dxm-providermodule
Installation
- In Jahia, go to Administration → Server settings → System components → Modules
- Upload the JAR clamav-filter-X.X.X.jar
- Verify the module status is Started
FAQ
Configuration
The module reads its settings from the OSGi configuration file:
$JAHIA_DATA_DIR/karaf/etc/org.jahia.community.clamav.cfg
| Property | Default | Description |
|---|---|---|
host |
localhost |
Hostname or IP address of the ClamAV daemon |
port |
3310 |
Port of the ClamAV daemon |
connection_timeout |
2000 |
Maximum time (ms) to wait when connecting to the daemon |
read_timeout |
20000 |
Maximum time (ms) to wait for the scan response |
Changes to the configuration file are applied immediately — no restart required.
Admin UI
Settings can also be edited directly in the Jahia administration panel:
Administration → Server Health → ClamAV Antivirus Settings
The UI allows editing all four settings, saving them, and testing the connection to the daemon. The connection is tested automatically when the page opens. The file scan test section is disabled when the daemon is not reachable.
How it works
- When a file is uploaded through Jahia (Media Manager, Forms, etc.), the upload filter intercepts the stream.
- The file content is forwarded to the ClamAV daemon over TCP using the
INSTREAMcommand. - If ClamAV reports a threat, the upload is rejected and the virus signature is logged.
- If ClamAV is unreachable (daemon down, wrong host/port, timeout), the upload is blocked by default to prevent unscanned files from reaching the repository.
Testing
Start a local ClamAV daemon with Docker:
docker run --interactive --tty --rm --publish 3310:3310 --name clamav clamav/clamav:stable
Wait for the container to print socket found, clamd started. before testing.
To trigger a detection, use the EICAR test file — a standard, harmless file that every compliant antivirus engine flags as malware.
Building from source
Requirements: JDK 17+, Maven 3.x, Node.js v22, Yarn v1.22
mvn clean install
The frontend assets are built automatically via the frontend-maven-plugin as part of the Maven build.
MIT License
Copyright (c) 2026 - present Florent BOURASSÉ
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Dependencies
Depended on by
Nothing depends on this module.