No Code Attached Yet
avatar vcmb-cyclo
vcmb-cyclo
30 Sep 2026

In Joomla 6.1.4, the Menu Title field in com_menus cannot store a literal less-than character (<).
The < character and all text following it are removed when the menu item is saved.
This prevents valid menu titles containing comparison expressions, for example:
Track < 20 km
The saved title becomes:
Track
A greater-than character works correctly:
Track > 20 km

Steps to reproduce

  1. Log in to the Joomla administrator interface as a Super User.
  2. Go to Menus and create or edit a menu item.
  3. Enter the following value in Menu Title:
    Track < 20 km
  4. Save the menu item.
  5. Reopen the menu item.

Expected result
The title is stored unchanged:
Track < 20 km
The character should be escaped when rendered in HTML, rather than removed when the value is saved.

Actual result
The title is truncated:
Track
The < character and everything following it are removed.
Using the encoded form does not solve the issue:
Track < 20 km
It is decoded and filtered in the same way.
Additional tests
This value is stored correctly:
Track > 20 km
This value is truncated:
Track < 20 km

Environment

  • Joomla: 6.1.4
  • PHP: 8.3.31
  • Database: MariaDB 11.8.6
  • User: Super User
  • Global Configuration → Text Filters → Super Users: No Filtering
  • No third-party extension is involved in saving the menu item.

Technical analysis
The field is defined in:
administrator/components/com_menus/forms/item.xml
as:

The field has no explicit filter attribute. FormField::filter() therefore passes an empty filter type to InputFilter, which falls back to the generic STRING filtering behavior.
The value is altered before ItemModel::save() and before the menu table is bound or stored.
The relevant processing path is:
FormModel::validate()
→ Form::process()
→ Form::filter()
→ FormField::filter()
→ InputFilter::clean()
→ InputFilter::cleanString()
→ InputFilter::cleanTags()
cleanTags() interprets the literal < as the beginning of an unterminated HTML tag and removes the remaining text.

The global text-filter setting is not consulted in this path, so selecting No Filtering for Super Users has no effect.

Why this should be considered a bug
A menu title is plain text and may legitimately contain mathematical or comparison characters.
Input sanitization should prevent HTML injection, but a literal comparison expression such as:

Track < 20 km
should be preserved in storage and safely escaped during HTML output.
The current behavior silently changes user data and makes some legitimate menu titles impossible to create.

Votes

# of Users Experiencing Issue
1/1
Average Importance Score
2.00

avatar vcmb-cyclo vcmb-cyclo - open - 30 Sep 2026
avatar vcmb-cyclo vcmb-cyclo - change - 30 Sep 2026
Labels Removed: ?
avatar joomla-cms-bot joomla-cms-bot - change - 30 Sep 2026
Labels Added: No Code Attached Yet
avatar joomla-cms-bot joomla-cms-bot - labeled - 30 Sep 2026
avatar brianteeman
brianteeman - comment - 30 Sep 2026

This is a security measure

Are you able to use the html entities &#62; and &#60;

avatar vcmb-cyclo
vcmb-cyclo - comment - 30 Sep 2026

Hi Brian,

OK, I understand this is a security measure.

I tested the HTML entities:

> for > → works

< for < → does not work, it is filtered in the same way as the literal < character.

So unfortunately, using an HTML entity does not solve the issue for <.

My use case is simply a plain-text menu title such as:

Tracks < 20 km

Is there a safe way to allow this character in a menu title while keeping the security filtering in place?

BR,

Gilles

De : Brian Teeman @.>
Envoyé : mercredi 30 septembre 2026 15:39
À : joomla/joomla-cms @.
>
Cc : vcmb-cyclo @.>; Author @.>
Objet : Re: [joomla/joomla-cms] Menu item title is truncated when it contains a literal (Issue #48532)

https://avatars.githubusercontent.com/u/1296369?s=20&v=4 brianteeman left a comment (#48532) #48532 (comment)

This is a security measure

Are you able to use the html entities > and <

—
Reply to this email directly, view it on GitHub #48532 , or unsubscribe https://github.com/notifications/unsubscribe-auth/BJUPLNREOZGCODFLEZZZLCT5RUEHTAVCNFSNUABDKJSXA33TNF2G64TZHMZDINRUHEYDQO2JONZXKZJ3GU3DINRZGYYTKMJUUF3AE .
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS https://github.com/notifications/mobile/ios/BJUPLNSSQDXVCPR2UJZ5ZOT5RUEHTA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKOJRGI2DIOBUGUY2M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG and Android https://github.com/notifications/mobile/android/BJUPLNTNM6P3PFWC2RLNFZT5RUEHTA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKOJRGI2DIOBUGUY2M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA . Download it today!
You are receiving this because you authored the thread. https://github.com/notifications/beacon/BJUPLNW47JLRXMAVFNKOQ5D5RUEHTBFCNFSM6AAAAADA3HTPJ2WGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTYAAAAACYDIZXB2M4TFMFZW63VGMF2XI2DPOI.gif Message ID: @.*** @.***> >

avatar brianteeman
brianteeman - comment - 30 Sep 2026

sorry i dont have any other ideas - hopefully someone else will have an idea

avatar richard67 richard67 - change - 30 Sep 2026
Title
…
Menu item title is truncated when it contains a literal
Menu item title is truncated when it contains a literal `
avatar richard67 richard67 - edited - 30 Sep 2026
avatar chmst
chmst - comment - 1 Oct 2026

I had an idea. Please test #48534

Add a Comment

Login with GitHub to post a comment