Skip to main content

Jahia 8.1.9.4

November 12, 2026

Jahia 8.1.9.4 is a patch release centered around security. You can find more details about the discovered vulnerabilities in the Security section of Jahia Academy.

Upgrading from a version earlier than 8.1.9.0? Make sure to review Jahia 8.1.9.0 release notes as well as all intermediary patch releases.

Read before you upgrade

Special upgrade instructions

Upgrading from a version older than 8.1.9.3
Jahia 8.1.9.3 introduces a permission change, which is applied during the upgrade from versions older than 8.1.9.3 and part of that work re-indexes content, including a pass over everything held under /sites.
While the migration runs, every write to the JCR is held up across the whole cluster, including logins that use the built-in remember-me option. Ordinary reads continue to be served.

We were made aware that in some situations, the migration can take longer than expected, especially on large sites. The duration depends on the size and complexity of your content repository. You are encouraged to plan accordingly and allocate sufficient time for the upgrade process.

If one of the migration scripts fails, it is renamed with a .failed suffix in the patches folder, the upgrade carries on and the script is never retried, which can leave the repository only partly hardened. Check for such a file after the upgrade, and contact support to have it applied.

Jahia 8.1.9.6 introduced improvements, if you are upgrading from a version of Jahia below 8.1.9.3, we encourage you to upgrade straight to 8.1.9.6 or above.

If you are already running Jahia 8.1.9.3+, the permission change was already performed in your environment, and you are not affected by this migration.

Breaking changes

Breaking changes are documented on the page of the release that introduced them. If you are upgrading across more than one version, review the breaking changes of every release between the version you are currently running and the version you are upgrading to.

This release contains no known breaking changes.

How to upgrade

Customers can always use the In-Place or Blue-Green upgrade procedure regardless of their current version. The rolling upgrade prerequisites below only apply to the rolling upgrade procedure.

Rolling upgrade to Jahia 8.1.9.4

Rolling upgrade to 8.1.9.4 from any version earlier than 8.1.9.0 is not supported.

Rolling upgrade from any 8.1.9.x version to 8.1.9.4 is supported, but requires the following modules to be upgraded on the cluster before starting the Jahia node upgrade:

Note: Depending of the version of Jahia you are upgrading from, some modules might already be in the required version.

If you are upgrading from a version older than 8.1.9.3, read the special upgrade instructions above before planning a rolling upgrade: the migration that runs during that upgrade holds up every write across the cluster, and a rolling upgrade neither avoids that pause nor keeps the site available while it runs.

Failing to upgrade these modules beforehand WILL result in instability during the rolling upgrade window when nodes are running different Jahia versions. Downgrading IS NOT supported.

If you are using Jahia installer, you can download fixAppliers corresponding to your Jahia version here.

Components updated in Jahia 8.1.9.4

Modules

ComponentJahia 8.1.9.3Jahia 8.1.9.4
ldap 📝4.6.04.8.0
macros 📝8.2.08.5.0
personal-api-tokens 📝1.9.01.10.0
rolesmanager 📝8.8.08.9.0
tools 📝4.6.04.7.0
userDashboard 📝8.5.08.8.1

Only components whose version changed in Jahia 8.1.9.4 are listed above.

The full list of Jahia modules and their versions can be found in the Jahia 8.1.9.4 tag in GitHub.

Database drivers

No changes to database drivers in this version.

The full list of Database drivers and their versions can be found in the Jahia 8.1.9.4 tag in GitHub.

Libraries

No changes to libraries in this version.

The full list of embedded Jahia libraries can be found in the Jahia 8.1.9.4 tag in GitHub.

Changelog

Security

  • 🛡️ Rejected Spring Web Flow request-parameter names carrying SpEL expression syntax before data binding, closing an unauthenticated remote code execution via expression-language injection (the name[<SpEL>] indexed-property form that bypassed the framework's own guard). (Commit: 936b04f)
  • 🛡️ The classic GWT-RPC endpoint now rejects a request whose serialization policy cannot be resolved (unknown strong name) instead of falling back to a permissive policy that skips the generated type allow-list. When this happens, typically with an out-of-date client after a server upgrade, the browser is now prompted to reload so it picks up the current application build. (Commit: 091cc29)
  • 🛡️ Generated-resource aggregation and legacy site-import archive extraction now reject any path that resolves outside their intended target directory. (Commit: 85b5a93)
  • 🛡️ The render URL resolver now accepts a trailing .ajax marker only once (as the terminal extension); a repeated .ajax suffix (e.g. <node>.raw.ajax.ajax) is rejected as not found instead of collapsing back to the underlying template. (Commit: 5339b82)
  • 🛡️ Turned off the deprecated HTML externalization render filter by default (opt-in via the new externalizeHtmlFilter.enabled property) and confined its stylesheet inlining to local .css resources. (Commit: 41ff814)
  • 🛡️ Closed an /atmosphere bypass where a GET request could be promoted to POST via an X-Atmosphere-Post-Body parameter, re-exposing the blocked vector. (Commit: 49b1d8a)
  • 🛡️ Hardened the back-end real-time channel (/atmosphere/rpc) to accept only same-origin connections from privileged (edit-mode) users. (Commit: b9d511a)
  • 🛡️ Hardened archive extraction so extracted entries stay within the destination folder. (Commit: ad973ab)
  • 🛡️ Safely handle special characters in site-search ordering property names and tag-suggest start path. (Commit: 5cfffa7)
  • 🛡️ Files served from /files are no longer MIME-sniffed, and SVG/HTML/XML files are served under a sandbox CSP so they cannot run script in the site origin on direct navigation. (Commit: 94cf01d)

Legend (icons): ✨ Improvements & new features, 🐛 Bugs, 🛡️ Security fixes, 📚 Documentation, 📦 Packaging, 🛠 Change to Jahia build, ⚙️ Changes to CI, ♻️ chores