In Joomla 6.1.4, the Menu Title field in com_menus cannot store a literal less-than character (<).
The < character and all text following it are removed when the menu item is saved.
This prevents valid menu titles containing comparison expressions, for example:
Track < 20 km
The saved title becomes:
Track
A greater-than character works correctly:
Track > 20 km
Steps to reproduce
Expected result
The title is stored unchanged:
Track < 20 km
The character should be escaped when rendered in HTML, rather than removed when the value is saved.
Actual result
The title is truncated:
Track
The < character and everything following it are removed.
Using the encoded form does not solve the issue:
Track < 20 km
It is decoded and filtered in the same way.
Additional tests
This value is stored correctly:
Track > 20 km
This value is truncated:
Track < 20 km
Environment
Technical analysis
The field is defined in:
administrator/components/com_menus/forms/item.xml
as:
The field has no explicit filter attribute. FormField::filter() therefore passes an empty filter type to InputFilter, which falls back to the generic STRING filtering behavior.
The value is altered before ItemModel::save() and before the menu table is bound or stored.
The relevant processing path is:
FormModel::validate()
→ Form::process()
→ Form::filter()
→ FormField::filter()
→ InputFilter::clean()
→ InputFilter::cleanString()
→ InputFilter::cleanTags()
cleanTags() interprets the literal < as the beginning of an unterminated HTML tag and removes the remaining text.
The global text-filter setting is not consulted in this path, so selecting No Filtering for Super Users has no effect.
Why this should be considered a bug
A menu title is plain text and may legitimately contain mathematical or comparison characters.
Input sanitization should prevent HTML injection, but a literal comparison expression such as:
Track < 20 km
should be preserved in storage and safely escaped during HTML output.
The current behavior silently changes user data and makes some legitimate menu titles impossible to create.
| Labels |
Removed:
?
|
||
| Labels |
Added:
No Code Attached Yet
|
||
Hi Brian,
OK, I understand this is a security measure.
I tested the HTML entities:
> for > → works
< for < → does not work, it is filtered in the same way as the literal < character.
So unfortunately, using an HTML entity does not solve the issue for <.
My use case is simply a plain-text menu title such as:
Tracks < 20 km
Is there a safe way to allow this character in a menu title while keeping the security filtering in place?
BR,
Gilles
De : Brian Teeman @.>
Envoyé : mercredi 30 septembre 2026 15:39
À : joomla/joomla-cms @.>
Cc : vcmb-cyclo @.>; Author @.>
Objet : Re: [joomla/joomla-cms] Menu item title is truncated when it contains a literal (Issue #48532)
https://avatars.githubusercontent.com/u/1296369?s=20&v=4 brianteeman left a comment (#48532) #48532 (comment)
This is a security measure
Are you able to use the html entities > and <
—
Reply to this email directly, view it on GitHub #48532 , or unsubscribe https://github.com/notifications/unsubscribe-auth/BJUPLNREOZGCODFLEZZZLCT5RUEHTAVCNFSNUABDKJSXA33TNF2G64TZHMZDINRUHEYDQO2JONZXKZJ3GU3DINRZGYYTKMJUUF3AE .
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS https://github.com/notifications/mobile/ios/BJUPLNSSQDXVCPR2UJZ5ZOT5RUEHTA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKOJRGI2DIOBUGUY2M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG and Android https://github.com/notifications/mobile/android/BJUPLNTNM6P3PFWC2RLNFZT5RUEHTA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKOJRGI2DIOBUGUY2M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA . Download it today!
You are receiving this because you authored the thread. https://github.com/notifications/beacon/BJUPLNW47JLRXMAVFNKOQ5D5RUEHTBFCNFSM6AAAAADA3HTPJ2WGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTYAAAAACYDIZXB2M4TFMFZW63VGMF2XI2DPOI.gif Message ID: @.*** @.***> >
sorry i dont have any other ideas - hopefully someone else will have an idea
| Title |
|
||||||
This is a security measure
Are you able to use the html entities
>and<