Steps to reproduce the issue

Audit finding

When uploading an extension package, the maximum file size is visually available near the drag-and-drop area and file-browse button.

However, the upload limit is not programmatically associated with the upload control. Assistive-technology users may reach the button before encountering the limit.

The report suggests using aria-describedby on the upload button and referencing the id of the upload-limit text. Its example associates a button with a message reading “Maximum upload size: 128.00 MB.”

User impact

Screen-reader users may activate the upload control without knowing the maximum permitted file size.

They may select a file that exceeds the limit, submit it, and only then receive an error. This creates unnecessary effort and may make the installation workflow harder to complete.

The issue affects people using screen readers and other assistive technology, as well as anyone relying on a programmatic relationship between the control and its constraint.

Remediation plan

Associate the upload constraint with the control that initiates the upload

• Associate the maximum upload size with the upload control using aria-describedby
• Give the upload-limit message a stable id and reference that id from the relevant control
• Ensure the limit is announced when assistive-technology users reach the upload control
• Keep the visible limit text available in context with the drag-and-drop area and browse control
• Ensure the relationship remains correct if the upload limit changes
• Ensure that any file-type restriction is also associated with the relevant control where it is a requirement for successful use
• Preserve keyboard operation, visible focus, and the existing upload behaviour
• Apply the corrected relationship to the shared upload component
• Verify the Installer's Upload Package File interface specifically
• Do not rely on visual proximity alone to convey the upload limit

Preconditions

• Use Joomla 6.2 with the Atum administrator template
• Sign in with an account permitted to access the Installer
• Use a test installation where the Upload Package File interface is available
• Record the exact Joomla build, browser name and version, operating system, viewport dimensions, and browser zoom
• Record the screen reader and browser combination if testing announcements
• Start at 100% browser zoom
• Record the displayed maximum upload size and any file-type restrictions
• Do not upload a production extension package during verification

Steps to reproduce

1. Open the Joomla administrator interface at the site's base URL followed by /administrator/
2. Open System → Install → Extensions
   • Alternatively, navigate to /administrator/index.php?option=com_installer on the same installation
   • Record the navigation labels if they differ in the tested build
3. Open the Upload Package File section
4. Locate the drag-and-drop upload area and the file-browse control
5. Locate the visible maximum upload size message
6. Inspect the upload control using Developer Tools
7. Record the control's element type, accessible name, aria-describedby, and any associated file input
8. Record the upload-limit message's id and text
9. Check whether the message is referenced by aria-describedby
10. Move keyboard focus to the upload control
11. Record whether the maximum upload size is announced with the control
12. Capture the upload control, limit message, and relevant DOM attributes
13. Repeat after reloading the page to confirm that the relationship is stable
14. Do not upload a file merely to trigger an error

Screen-reader verification

1. Use a screen reader with the browser combination being tested
2. Navigate to the Upload Package File section
3. Navigate to the drag-and-drop upload area or browse control
4. Record the control's announced name, role, and description
5. Check whether the maximum upload size is announced when the control receives focus
6. Navigate away from and back to the control to check whether the description remains available
7. Repeat with at least one additional screen reader if available
8. Record the screen-reader name, version, browser, and operating system
9. Do not upload a file during this verification

Verification after remediation

1. Open the Upload Package File interface
2. Confirm that the maximum upload size is programmatically associated with the upload control
3. Confirm that a screen reader announces the limit when the control receives focus
4. Confirm that the visible limit message remains available in context
5. Confirm that the upload control remains keyboard operable and visibly focused
6. If the upload limit is dynamic, confirm that the associated description updates correctly
7. Record the final DOM relationship, visible message, and screen-reader announcement

Version

6.2

Expected result

The maximum upload size is programmatically associated with the upload control in the Upload Package File interface.

Assistive-technology users can learn the limit when they reach the upload control, rather than only after selecting or submitting an oversized file.

The upload control remains keyboard operable, visibly focused, and correctly associated with its constraint.

Actual result

The maximum upload size is visually available near the upload control but is not programmatically associated with it.

Assistive-technology users may reach the upload button before noticing the limit.

The current Joomla 6.2 build needs to be checked to establish whether the issue persists and to record the displayed limit.

What device were you using? (eg, phone, laptop)

Desktop web

What web browser were you using? (eg, Chrome, Safari)

Chrome, Firefox, Edge, Safari

Assistive Technology?

VoiceOver, JAWS, NVDA

Additional Comments

The browser and assistive-technology entries above are carried forward from the original issue and do not represent a new verification of every combination against Joomla 6.2.

Development is the responsibility tag in the original report.

The report's aria-describedby example is one possible remediation. Verify the chosen implementation with assistive technology.

The reported 128.00 MB limit describes the audited environment. Record the actual limit displayed in the tested installation.

This issue concerns the programmatic association of the upload limit. It does not require changing the server-side upload limit or the file-validation behaviour.

MS2b is proposed for the shared upload component, with MS3b covering the documented Installer integration.