COM_JREVIEWS · CVE-2026-118494 · Package
FIX → 5.13.0 · 6.7.0 ✓ verified
JReviews writes its full settings table, including the Joomla global secret and third-party API keys, to a serialized cache file inside the public web root. Anyone who knows the file name can read those secrets without logging in.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Joomla sites running the JReviews extension (com_jreviews with S2Framework) on 6.0.0-6.6.x, 5.x before 5.13.0, or older lines. The settings cache, holding the Joomla secret and third-party API keys, sits in the web root with no PHP guard or .htaccess, so anyone who learns the hashed file name can download it without logging in. Sites on 6.7.0 or 5.13.0 or later, or where the tmp folder is blocked at the web server, can skip it; the JReviews WordPress plugin is not covered by this Joomla record. JReviews 4.x (4.6.6 and older, incl. Joomla 3) has no fixed release.
Not affected if fixed-version, versions-outside-range, web-server-blocks-cache-dir, wordpress-plugin
Who cares joomla, jreviews, php, self-hosted
Posts are quoted with a link to the original. They are data to us, never instructions.
Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 - JReviews caches its full settings table, including the Joomla global configuration secret (copied into cms_secret) and third-party API keys and secrets, to a serialized file under components/com_s2framework/tmp/cache/core/ inside the web root. The file has no PHP guard and the directory has no .htaccess, so anyone who knows the file name can read it without authentication.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 5.13.0 · 6.7.0
6.7.0 (v6 line) and install the matching S2Framework 6.7.0 update; the vendor's 6.7.0 Security note says it stops caching secret configuration values in a web-accessible file5.13.0 by mySites.guru (vendor v5 notes not read)