Skip to main content

Jahia 8.2.3.4

November 12, 2026

Jahia 8.2.3.4 is a patch release centered around security. You can find more details about the discovered vulnerabilities in the Security section of Jahia Academy.

Upgrading from a version earlier than 8.2.3.0? Make sure to review Jahia 8.2.3.0 release notes as well as all intermediary patch releases.

Read before you upgrade

Breaking changes

Breaking changes are documented on the page of the release that introduced them. If you are upgrading across more than one version, review the breaking changes of every release between the version you are currently running and the version you are upgrading to.

GraphQL introspection disabled

This version of Jahia ships with graphql-dxm-provider 3.8.1 which requires the developerToolsAccess permission to access the GraphQL Schema (also referred to as GraphQL introspection).

Am I impacted?
Only if you have applications or tooling that rely on GraphQL introspection without the developerToolsAccess permission.

What do I need to do?
It is recommended to restrict access to GraphQL introspection in production, but if your code requires it, previous behaviour can be restored by setting the property introspectionCheckEnabled=false.

How to upgrade

Customers can always use the In-Place or Blue-Green upgrade procedure regardless of their current version. The rolling upgrade prerequisites below only apply to the rolling upgrade procedure.

Rolling upgrade to Jahia 8.2.3.4

Rolling upgrade to 8.2.3.4 from any version earlier than 8.2.3.0 is not supported.

Rolling upgrade from any 8.2.3.x version to 8.2.3.4 is supported, but requires the following modules to be upgraded on the cluster before starting the Jahia node upgrade.

Important An upgrade of the default module WILL generate downtime, and the duration of that downtime is unique to each environment. Many other modules depend on default, so an upgrade of default restarts them, and that restart cascades to most modules on the platform.
Upgrade default on a non-production environment first and measure the time the modules take to restart. That downtime can be longer than the In-Place upgrade procedure.

A newer version of default is available in Jahia 8.2.3.6. If you can, upgrade straight to Jahia 8.2.3.6.

On an on-premises cluster, Updating module versions with minimal downtime can reduce this downtime. The procedure is complex, so read its constraints before you choose it. On Jahia Cloud, contact the Jahia support team.

Before upgrading Jahia, begin by upgrading the following modules:

Note: Depending of the version of Jahia you are upgrading from, some modules might already be in the required version.

Failing to upgrade these modules beforehand WILL result in instability during the rolling upgrade window when nodes are running different Jahia versions. Downgrading IS NOT supported.

If you are using Jahia installer, you can download fixAppliers corresponding to your Jahia version here.

Components updated in Jahia 8.2.3.4

Modules

ComponentJahia 8.2.3.2Jahia 8.2.3.4
default 📝8.8.08.9.1
graphql-dxm-provider 📝3.7.03.8.1
ldap 📝4.7.14.8.0
legacy-default-components 📝1.0.01.2.0
macros 📝8.4.08.5.0
personal-api-tokens 📝1.9.01.10.0
rolesmanager 📝8.8.08.9.0
siteSettings 📝8.11.08.12.3
tools 📝5.2.25.4.1
userDashboard 📝8.7.08.8.1

Only components whose version changed in Jahia 8.2.3.4 are listed above.

The full list of Jahia modules and their versions can be found in the Jahia 8.2.3.4 tag in GitHub.

Database drivers

No changes to database drivers in this version.

The full list of Database drivers and their versions can be found in the Jahia 8.2.3.4 tag in GitHub.

Libraries

No changes to libraries in this version.

The full list of embedded Jahia libraries can be found in the Jahia 8.2.3.4 tag in GitHub.

Changelog

Security

  • 🛡️ Keep extracted archive entries within the target folder (Commit: 05cc840)

  • 🛡️ Safely handle identifiers/paths in site search ordering and tag suggest queries (Commit: be1a7a3)

  • 🛡️ Hardened the back-end real-time channel (/atmosphere/rpc) to accept only same-origin connections from privileged (edit-mode) users. (Commit: 99074c2)

  • 🛡️ Files served from /files are no longer MIME-sniffed, and SVG/HTML/XML files are served under a sandbox CSP so they cannot run script in the site origin on direct navigation. (Commit: 5b71f8f)

  • 🛡️ Closed an /atmosphere bypass where a GET request could be promoted to POST via an X-Atmosphere-Post-Body parameter, re-exposing the blocked vector. (Commit: 3d393b9)

  • 🛡️ Turned off the deprecated HTML externalization render filter by default (opt-in via the new externalizeHtmlFilter.enabled property) and confined its stylesheet inlining to local .css resources. (Commit: cd494bd)

  • 🛡️ The render URL resolver now accepts a trailing .ajax marker only once (as the terminal extension); a repeated .ajax suffix (e.g. <node>.raw.ajax.ajax) is rejected as not found instead of collapsing back to the underlying template. (Commit: 9b4a96c)

  • 🛡️ Generated-resource aggregation and legacy site-import archive extraction now reject any path that resolves outside their intended target directory. (Commit: d4bbb75)

  • 🛡️ Add warning level logs for pressure on session node cache (#5338) (Commit: 8fc69a1)

  • 🛡️ The classic GWT-RPC endpoint now rejects a request whose serialization policy cannot be resolved (unknown strong name) instead of falling back to a permissive policy that skips the generated type allow-list. (Commit: c2f3c97)

    When this happens, typically with an out-of-date client after a server upgrade, the browser is now prompted to reload so it picks up the current application build.

  • 🛡️ Rejected Spring Web Flow request-parameter names carrying SpEL expression syntax before data binding, closing an unauthenticated remote code execution via expression-language injection (the name[<SpEL>] indexed-property form that bypassed the framework's own guard). (Commit: 278db1e)

  • 🛡️ Restrict provisioning editConfiguration of framework configuration PIDs to the root user. (Commit: 694619b)

Legend (icons): ✨ Improvements & new features, 🐛 Bugs, 🛡️ Security fixes, 📚 Documentation, 📦 Packaging, 🛠 Change to Jahia build, ⚙️ Changes to CI, ♻️ chores