HikaShop 6.5.2 is a maintenance release. It fixes a security issue along with several bugs, and we recommend that all merchants update.
Security fix: open redirect in the currency switcher
We fixed a medium severity open redirect vulnerability in the currency switcher. When a visitor changed the currency, HikaShop could send them back to an address passed in the link. A specially crafted link, using a doubly encoded web address, could get past the safety check and send the visitor to an external website instead of back to your shop.
This kind of flaw does not expose any data by itself, but it can be abused in phishing: an attacker sends a link that starts on your genuine domain and then bounces the visitor to a look-alike site. The visitor sees your address at first and is more easily fooled.
Affected versions: all editions of HikaShop (Starter, Essential and Business), from the earliest versions up to and including 6.5.1. The issue is fixed in 6.5.2, released today, the 20th of July 2026.
The address a visitor is sent back to is now fully decoded and checked before the redirection, so only addresses on your own site are accepted.
Update recommended
Because this fix concerns security, we advise every merchant to update to 6.5.2 as soon as possible, using the one click updater in your back-end or the package from your member area.
HikaShop 6.5.2 also includes a number of other bug fixes. You can see the full list in the change log.
If you cannot update right away
If you are on an older version and cannot update to 6.5.2 immediately, you can apply the security fix by hand. Open the front-end currency controller, the file components/com_hikashop/controllers/currency.php, and find these two lines:
if(hikashop_disallowUrlRedirect($url)) return false; $app->redirect(urldecode($url));
Replace them with:
$url = urldecode($url); if(hikashop_disallowUrlRedirect($url)) return false; $app->redirect($url);
The same two lines are also present in the back-end controller, administrator/components/com_hikashop/controllers/currency.php; apply the same change there. This decodes the return address first and then checks the exact address the visitor will be sent to, so the safety check can no longer be bypassed. Clear your Joomla cache afterwards.
