Skip to main content
Jahia Store
EN

Request Safety Patch

supported
Download 1.14.1

Information

Module ID
request-safety-patch
Group ID
org.jahia.modules
Status
supported
Category
Security
Author
JSG
Developer website
http://www.jahia.com
Requires Jahia
8.0.0.0
Updated
2026-08-05
Source
scm:git:git@github.com:Jahia/request-safety-patch.git
Tags
  • security

This module protects against two security vulnerabilities discovered in Jahia and documented on the Academy: https://academy.jahia.com/customer-center/security/security-advisories/security-patch-june-2026-jahia

Versions

1.14.1Download
  • Disable double slash rejection by default, this corrects compatibility issues noticed with some other Jahia modules
Requires Jahia 8.0.0.0Updated 2026-08-05
1.12.0Download
  • Fixed the WebFlow expression-injection guard blanking unrelated pages: it now inspects only WebFlow fragments, so a request parameter name containing a parenthesis (as produced by routine vulnerability scanners) no longer renders an empty page nor stores that empty page in the HTML cache for subsequent visitors. Protection against the injection itself is unchanged.
  • Enlarge the scope of the detection for malformed URL. 
Requires Jahia 8.0.0.0Updated 2026-07-30
1.11.1Download

Bug fixes

  • Ensured we blanked only nt_base/html/link.jsp views 
Requires Jahia 8.0.0.0Updated 2026-07-28
1.10.0Download

Improvements

  • Ensured the built-in link component always renders through this patch's safe view: any other source of that view is now blocked, so request parameters can no longer be reflected unescaped through it.
  • Blocked double-encoded URLs before security filters to prevent unauthenticated access to admin tools.
Requires Jahia 8.0.0.0Updated 2026-07-24

Improvements

Hardened the /atmosphere X-Atmosphere-Post-Body block to scan the raw query string

Requires Jahia 8.0.0.0Updated 2026-07-15

Improvements

Closed an additional /atmosphere bypass using a GET request

Requires Jahia 8.0.0.0Updated 2026-07-14

Improvements

Escapes nt:base link view params and pause HTML externalization filter

Requires Jahia 8.0.0.0Updated 2026-07-14

Improvements

  • Closed /atmosphere/rpc filter bypass
Requires Jahia 8.0.0.0Updated 2026-06-26

Initial version of the module

Requires Jahia 8.0.0.0Updated 2026-06-01