{
 "slug": "joomla",
 "name": "Joomla",
 "tagline": "Content management system for websites and online applications",
 "category": "cms-ecommerce",
 "use_cases": [
  "cms",
  "websites",
  "content-publishing"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Open Source Matters, Inc.",
  "url": "https://www.joomla.org",
  "license": "GPL-2.0-or-later",
  "license_url": "https://github.com/joomla/joomla-cms/blob/5.4.6/LICENSE.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "5.4.10",
   "last_build": "2026-10-23",
   "entity_id": "prod-nj7zpbvyojysu",
   "ami_alias": "/aws/service/marketplace/prod-nj7zpbvyojysu/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-katesmj53ycp6",
   "recommended_instance_type": "t3.medium",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "5.4.10",
   "last_build": "2026-10-24",
   "offer_id": "joomla",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:joomla:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.joomla?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/joomla/",
  "json": "https://lynxroute.com/products/joomla/product.json"
 },
 "release_notes": [
  {
   "version": "5.4.10",
   "title": "Joomla 5.4.10",
   "notes": "* Joomla updated 5.4.9 -> 5.4.10, a bugfix release. GPL-2.0-or-later unchanged\n* Web services API PATCH fixes; banners now respect category access and published state\n* Security: ships the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619; unauthenticated remote code execution in PHP) via Ubuntu php8.3 8.3.6-0ubuntu0.24.04.13 (USN-8948-1). Earlier images of this product carry the vulnerable PHP and should be replaced\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23",
    "azure": "2026-10-24"
   }
  },
  {
   "version": "5.4.9",
   "title": "Joomla 5.4.9",
   "notes": "* Joomla 5.4.9 on Ubuntu 24.04 LTS - security and bugfix release (from 5.4.8). GPL-2.0-or-later unchanged\n* Upstream classifies this as a security release and recommends installing it as soon as possible\n* 16 security fixes, including cross-site scripting and filter bypasses, access-control checks on web service endpoints, unauthorized account creation, and a multi-factor authentication bypass through remember-me cookies\n* More than 50 merged pull requests from 20+ contributors, including fixes in the template and media managers\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-02",
    "azure": "2026-10-02"
   }
  },
  {
   "version": "5.4.8",
   "title": "Joomla 5.4.8",
   "notes": "* Joomla 5.4.8 on Ubuntu 24.04 LTS - security and bugfix release (from 5.4.7). GPL-2.0-or-later unchanged\n* Upstream classifies this as a security release and recommends installing it as soon as possible\n* 32 merged pull requests from more than 30 contributors across the CMS and the administrator interface\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-23",
    "azure": "2026-09-06"
   }
  },
  {
   "version": "5.4.6",
   "title": "Joomla 5.4.6",
   "notes": "* Joomla 5.4.6 (5.x LTS) on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Nginx + PHP 8.3-FPM + MariaDB; Super User and database credentials generated at first launch\n* HTTPS on by default (self-signed); Certbot pre-installed for Let's Encrypt\n* MariaDB bound to localhost only; web installer removed automatically\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-api",
   "live": {
    "aws": "2026-06-20"
   }
  }
 ],
 "release_history": [
  {
   "version": "5.4.10",
   "aws": "2026-10-23",
   "azure": "2026-10-24"
  },
  {
   "version": "5.4.9",
   "aws": "2026-10-02",
   "azure": "2026-10-02"
  },
  {
   "version": "5.4.8",
   "aws": "2026-08-23",
   "azure": "2026-09-06"
  },
  {
   "version": "5.4.7",
   "aws": "2026-07-10",
   "azure": "2026-07-11"
  },
  {
   "version": "5.4.6",
   "aws": "2026-06-20"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-nj7zpbvyojysu/latest \\\n  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer joomla --plan payg-gen2\naz vm create -g my-rg -n joomla --size Standard_D2s_v3 \\\n  --image lynxroute:joomla:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Joomla is a mature open-source content management system (CMS) for building websites, blogs, corporate portals, and intranets. It is a PHP 8.3 web application served by Nginx with PHP-FPM and backed by a MariaDB database. The bundled feature set covers article and content management with categories and tags, a templating system for site themes, flexible menu management, multilingual sites, fine-grained user management and access control levels (ACL), a media manager, banners, contacts, news feeds, and a powerful extension system of components, modules, and plugins. Thousands of free and commercial extensions and templates are available from the Joomla Extensions Directory. A self-hosted alternative to WordPress and Drupal for structured, multi-author content. GPL-2.0-or-later license - no per-seat fees, no vendor lock-in, all data inside your own AWS account.",
  "image_adds": "Security hardening:\n* Super User and MariaDB credentials generated at first launch (saved to /root/joomla-credentials.txt)\n* Web installer runs non-interactively and the installation folder is removed automatically\n* HTTPS on by default (self-signed) with HTTP redirected to HTTPS; Certbot pre-installed for Let's Encrypt in one command\n* MariaDB database accessible from localhost only\n* PHP-FPM bound to loopback behind the Nginx reverse proxy\n* UFW firewall - ports 22, 80, 443 only\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}