Next File Manager
Next File Manager is a Joomla-native file manager built as a React single-page app inside the admin. It browses the Joomla install itself and any number of additional drives — a folder on this server, an SFTP or FTP/FTPS host, a WebDAV or Nextcloud share, an S3-compatible bucket — through one interface. Access is granted through profiles: a permission set that names which folders a user may see, which of sixteen file operations they may run, how large their uploads may be and which extensions they may send. Profiles attach to individual Joomla users or to whole user groups, so a contributor gets their own folder and nothing else, with no second password to issue.
Browse in grid or list view with a live folder tree, drag files between folders, upload by dropping them on the window, preview images and media in a lightbox, edit text and code in a syntax-highlighting editor, create and extract ZIP archives, and search across a folder tree. Sensitive files are protected out of the box — configuration.php, .env files and private keys can never be read or downloaded below Super User, and the administrator tree is write-protected until an admin explicitly unlocks a path. Every mutation is written to an activity log with the user, the operation and the target.
See it in action
Everything you need
File Browser
Everything you expect from a desktop file manager, in the Joomla admin.
Grid & List Views
Switch between a tile grid with large type icons and a dense sortable list.
Live Folder Tree
A lazy-loading sidebar tree of every folder you have access to, with breadcrumbs above the pane.
Drag to Move
Drag a selection onto a tree node or a folder tile to move it, with a confirmation on overwrite.
Right-Click Menu
A full context menu carrying every operation your profile allows — and only those.
Info Panel
Size, type, modified date, path and permissions for the current selection.
Transfers
Get files in and out without a separate FTP client.
Drop-Anywhere Upload
Drop files on the window to queue them; a progress list shows each transfer and its outcome.
Per-Profile Upload Rules
Maximum file size, an allowed-extension list and an always-blocked denied list, enforced on the server.
Download & ZIP Download
Download a single file, or select several and get them as one archive.
Cross-Drive Copy & Move
Copy or move between two different drives — the transfer is streamed, so large files do not need to fit in memory.
Editing & Preview
Read and change files in place.
Syntax-Highlighting Editor
A CodeMirror editor with modes for PHP, JavaScript, CSS, HTML, JSON, SQL, XML and Markdown.
Image & Media Lightbox
Full-screen preview for images and media, with byte-range streaming so video can be scrubbed.
Rename, Duplicate, New Folder
The everyday operations, each individually grantable.
Archives
Pack and unpack without shell access.
Create ZIP
Archive any selection in place.
Extract In Place
Unpack an archive into its folder, with Zip-Slip path traversal blocked on every entry.
Access-Checked Contents
Archive downloads honour the same protection rules as direct downloads — a protected file cannot be smuggled out inside a ZIP.
Storage & Places
One interface over every filesystem you use.
Five Drivers
Server folder, SFTP (SSH), FTP/FTPS, WebDAV/Nextcloud and S3-compatible object storage.
Storage / Place Split
A storage holds credentials and a base; places name the folders on it — so one SFTP account exposes several folders without re-entering its password.
Encrypted Credentials
Passwords and private keys are stored as ciphertext keyed off the Joomla site secret, and never sent back to the browser.
Capability Negotiation
Each driver declares what it can actually do, and the UI hides operations the protocol does not support instead of failing deep inside an adapter.
Test Before Save
A live connection check from the storage editor, which also fills in the SFTP host fingerprint for you.
Access Control
Joomla-native permissions that go well past on/off.
Profiles
A named permission set: granted folders, sixteen togglable operations, upload limits and feature gates.
Scoped Roots
Each grant is a place plus an optional subfolder plus a read/write flag — a user sees that subtree and nothing above it.
User & Group Assignment
Assign a profile to individual users or to whole Joomla user groups; a direct assignment wins over a group one.
Deny by Default
A user with no profile gets nothing. Every operation is re-checked on the server regardless of what the UI offers.
Protection
Safe defaults that survive a misconfigured profile.
Protected Paths
An editable pattern list — shipping with `configuration.php`, `.htaccess`, `administrator/`, `libraries/` and more — that blocks writes to a path and everything under it.
Secret Files Are Unreadable
`configuration.php`, `.env`, `*.key`, `*.pem` and `.htpasswd` cannot be read, downloaded, previewed or copied below Super User.
Per-Path Locks
Right-click to lock an item; a Super User can grant a specific unlock override, gated behind a global switch that is off by default.
Path Traversal Hardening
Every path is canonicalised and re-checked against its granted root, including on case-insensitive filesystems and through symlinks.
Activity Log
Answer "who changed what, and when".
Every Mutation Recorded
Uploads, deletions, renames, moves, copies, edits, archive operations and lock changes.
Filterable Viewer
A searchable data grid with per-column filters over user, action, place and path.
Admin-Only
The log tab is visible to Super Users and never exposed to profiled users.
Site Front End
Put the file manager on the public site, not just the admin.
Menu-Item Driven
Publish the same SPA through a Joomla menu item for logged-in front-end users.
Same Enforcement
The front-end dispatcher runs the identical profile checks, protection rules and command allowlist as the admin.
Session-Aware
When a session expires, an in-place dialog re-authenticates and replays the interrupted request instead of dumping the user on a login page.
Developer
A modern stack with no deprecated Joomla APIs.
Single-page App
Single-page admin built on React
Namespaced Joomla MVC
DI service providers, namespaced controllers and Joomla's own database layer throughout.
Theme-Synced
The interface follows Joomla's own light/dark colour scheme automatically.
Open Source
GNU GPL v2 or later.
Built for the EU Cyber Resilience Act
Free security updates for at least 5 years from your purchase
Every customer — active or lapsed — can download security fixes from the Customer Portal throughout their support period, in line with the EU Cyber Resilience Act.
Frequently Asked Questions
Getting Started
Go to Components > Next File Manager. It opens on the file browser, already pointing at your Joomla install — Super Users get full access with no configuration at all. Everything else lives under the Configuration tab.
No. One storage and one place ship built in: the "site" place, which always resolves to the live Joomla root. You only add storage when you want to reach a different filesystem — another folder on the server, or a remote host.
Create a profile under Configuration > Profiles. Tick the operations they may run, add one or more roots (a place plus an optional subfolder, marked read-only or writable), set any upload limits, then assign it to the user or to a user group. Users with no profile get nothing.
A storage is how to reach a filesystem — a driver plus its credentials. A place is a named folder on that storage that profiles can grant. The split exists so one SFTP account can expose several folders under different names and access rules without entering its password more than once.
Access & Security
No. Each root is a place plus a subfolder, and every request is resolved by canonicalising the requested path and confirming it still sits inside that root — after symlinks are followed, and folding case on filesystems that ignore it. A ../ path never escapes.
Not below Super User, by any route. configuration.php, .env files, *.key, *.pem and .htpasswd are treated as secret: they cannot be read, previewed, downloaded, copied, or pulled out inside a ZIP archive. This is separate from the protected-paths list, which governs writes.
Writes are blocked to configuration.php, index.php, .htaccess, .user.ini, web.config and the administrator/, cli/, includes/ and libraries/ trees, plus everything beneath them. The list is editable by Super Users under Settings, and a matched pattern protects the path and its whole subtree.
No — the UI gating is convenience only. The server re-checks the acting user's profile, the protected-path rules and the driver's declared capabilities on every single request, so a crafted call gets the same answer as a hidden button.
Yes, deliberately awkwardly. Turn on Allow Super Users to unlock & edit protected files in Settings (off by default, Super-User-only), then use the right-click Unlock action on the specific path. Evaluation is nearest-ancestor-wins, so the override applies to that item and nothing else.
Storage
SFTP over SSH, FTP and FTPS, WebDAV — including Nextcloud and ownCloud — and any S3-compatible object store: Amazon S3, MinIO, Wasabi, Cloudflare R2 and DigitalOcean Spaces.
No, and that is by design. Object stores have no real directories, and several protocols cannot rename or read byte ranges. Each driver declares its capabilities up front; the interface hides what the protocol cannot do rather than letting it fail deep inside an adapter, and the server refuses it anyway if a request slips through.
Encrypted in the storage row, keyed off your Joomla site secret. The plain-text value is never written to disk and never returned to the browser — the editor only receives a flag saying whether a secret is set, so saving a label cannot wipe a password.
Yes. Paste an OpenSSH private key, with a passphrase if it has one. You can also pin the host key fingerprint; Test Connection fills it in for you.
Yes. Copy and move work across drives, and the transfer is streamed rather than buffered, so a file larger than PHP's memory limit still goes through.
Technical
Joomla 4, 5 and 6 on PHP 8.1 or higher. The component uses namespaced MVC and DI service providers throughout, with no deprecated APIs.
No. Everything runs in Joomla's own PHP process — archives use PHP's ZIP support, SFTP uses the phpseclib library that ships with Joomla, and S3 requests are signed in PHP. FTP needs PHP's ftp extension; if it is missing, the driver says so instead of failing.
Every mutation — upload, delete, rename, move, copy, edit, archive, extract and lock changes — with the acting user, the action, the place and the path, stored in the component's own log table and viewable under Activity Log.
Yes. The package installs a site component; create a Joomla menu item pointing at it and logged-in front-end users get the same SPA, running the same profile checks and protection rules as the admin.
Yes. Licensed under GNU GPL v2 or later. Sold commercially on nextsoftware.dev with priority support and update delivery; the source itself is open.