Version 8.2.12.1

Version Highlights

Release Date: 17 August 2026
Editions: Enterprise & Cloud Editions
Focus Areas: Bug fix

This version fixes an issue in the JasperReports UI Menu where an unauthenticated remote code execution (RCE) vulnerability exists through the JasperReportsMenu plugin, affecting ALL versions of Joget, regardless of whether JasperReports is utilized within the application. The flaw stems from an anonymously accessible endpoint that processes caller-controlled userview JSON without adequate restriction, allowing attackers to supply malicious JRXML report markup. See Security Advisories for mitigation steps.

Full Changelogs

Bug Fixes and Improvements

Enterprise & Cloud

    [ FIXED ]       CORE      : JasperReports Menu - Force class-filter on for JRXML compile/fill to close unauthenticated RCE; gate JasperReportsMenu/CalendarMenu json-preview to admin-only, correctly ordered before response.getOutputStream().