{"id":"CVE-2026-118494","kind":"vulnerability","aliases":["CVE-2026-118494"],"related":[],"title":"JReviews Joomla extension: cached settings file exposes secrets to anyone","description":"Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 - JReviews caches its full settings table, including the Joomla global configuration secret (copied into cms_secret) and third-party API keys and secrets, to a serialized file under components/com_s2framework/tmp/cache/core/ inside the web root. The file has no PHP guard and the directory has no .htaccess, so anyone who knows the file name can read it without authentication.","summary":"JReviews writes its full settings table, including the Joomla global secret and third-party API keys, to a serialized cache file inside the public web root. Anyone who knows the file name can read those secrets without logging in.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"com_jreviews","fixed":["5.13.0","6.7.0"],"affected":">= 1.0.0, <= 5.12.0; >= 6.0.0, <= 6.6.9","ecosystem":"joomla"}],"ecosystems":[],"tags":["joomla","jreviews","package","php","self-hosted"],"not_affected_if":["fixed-version","versions-outside-range","web-server-blocks-cache-dir","wordpress-plugin"],"how_to_check":"- Check the installed JReviews version in Joomla admin: Extensions > Manage. Affected: 6.0.0-6.6.x and 5.x below 5.13.0 (and older lines, 4.x has no fix).\n- Look in components/com_s2framework/tmp/cache/core/ under the web root for files with jreviews_config in the name; if present, test whether they download over HTTP. The file name ends in a hash that includes the Joomla secret, so it is only reachable if the name leaks (directory listing, backup, logs, another file-read flaw).\n- Also check whether directory listing is on for that folder.","fix":"Update JReviews to 6.7.0 (v6 line) and install the matching S2Framework 6.7.0 update; the vendor's 6.7.0 Security note says it stops caching secret configuration values in a web-accessible file. The v5 line is reported fixed in 5.13.0 by mySites.guru (vendor v5 notes not read). After updating, clear the JReviews cache and delete any leftover jreviews_config cache file, then rotate the Joomla secret, cron secret and third-party API keys if the file could have been reached.","status":"open","published_at":"2026-11-05T19:17:12+00:00","first_seen_at":"2026-11-05T19:40:35+00:00","triaged_at":"2026-11-05T19:42:52+00:00","updated_at":"2026-11-05T19:44:11+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-05T19:42:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"JReviews Joomla extension: cached settings file exposes secrets to anyone","impact":"high","summary":"JReviews writes its full settings table, including the Joomla global secret and third-party API keys, to a serialized cache file inside the public web root. Anyone who knows the file name can read those secrets without logging in.","audience":"businesses","category":"package","nicknames":[],"who_cares":["joomla","jreviews","self-hosted","php"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads the Joomla global secret and third-party API keys without logging in","analyst_note":"Confirm the fixed version for JReviews from the vendor advisory; the sources give only affected ranges, and the NVD entry does not state a patch.","how_to_check":"- Look for the directory `components/com_s2framework/tmp/cache/core/` under the Joomla web root and check whether serialized cache files are present and reachable over HTTP.\n- Check the installed JReviews version against the affected ranges (1.0.0-5.12.0, 6.0.0-6.6.9).","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-range","web-server-blocks-cache-dir"],"who_is_affected":"Sites running the JReviews extension for Joomla within the affected version ranges. The exposure comes from the cache directory being inside the web root with no PHP guard or .htaccess block, so any site running these versions with that directory served over HTTP is exposed. Sites on versions outside the ranges, or where the directory is blocked at the web server, are not affected by this description.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000734,"input_tokens":4327,"output_tokens":603,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version for JReviews from the vendor advisory; the sources give only affected ranges, and the NVD entry does not state a patch.","search":"'-118494':13A,16A '-2026':12A,15A '1.0.0':78C '5.12.0':79C '6.0.0':80C '6.6.9':81C 'access':75C 'anyon':10A,53B,129C 'api':41B,102C 'authent':139C 'cach':4A,46B,70C,83C 'cms':96C 'com':17A 'components/com_s2framework/tmp/cache/core':111C 'config':69C 'configur':92C 'copi':94C 'cve':11A,14A 'directori':124C 'expos':7A 'extens':3A,66C 'file':6A,47B,57B,109C,117C,133C 'full':29B,85C 'global':35B,91C 'guard':121C 'host':25B 'htaccess':127C 'includ':32B,88C 'insid':48B,112C 'joomla':2A,19B,34B,65C,90C 'jreview':1A,20B,26B,77C,82C 'jreviews':18A 'jreviews.com':67C 'key':42B,103C 'know':55B,131C 'log':64B 'name':58B,134C 'packag':21B 'parti':40B,101C 'php':22B,120C 'public':50B 'read':60B,136C 'root':52B,115C 'secret':8A,36B,62B,68C,93C,97C,105C 'self':24B 'self-host':23B 'serial':45B,108C 'set':5A,30B,86C 'tabl':31B,87C 'third':39B,100C 'third-parti':38B,99C 'web':51B,74C,114C 'web-access':73C 'without':63B,138C 'write':27B","nicknames":[],"mitigations":[],"who_affected":"Joomla sites running the JReviews extension (com_jreviews with S2Framework) on 6.0.0-6.6.x, 5.x before 5.13.0, or older lines. The settings cache, holding the Joomla secret and third-party API keys, sits in the web root with no PHP guard or .htaccess, so anyone who learns the hashed file name can download it without logging in. Sites on 6.7.0 or 5.13.0 or later, or where the tmp folder is blocked at the web server, can skip it; the JReviews WordPress plugin is not covered by this Joomla record. JReviews 4.x (4.6.6 and older, incl. Joomla 3) has no fixed release.","tier":"B","verified":{"fix":{"at":"2026-11-05T19:44:11Z","by":"analyst","doc":"https://www.jreviews.com/docs/v6/release-notes","run_id":1824}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["comjreviews"],"ptokens":["com","jreviews"],"labels":["high","joomla","jreviews","package","php","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T19:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118494","severity":null,"published_at":"2026-11-05T19:17:12+00:00","modified_at":"2026-11-05T19:17:12+00:00","first_seen_at":"2026-11-05T19:40:35+00:00","fetched_at":"2026-11-05T19:40:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118494:1824","url":"https://www.jreviews.com/docs/v6/release-notes","severity":null,"published_at":"2026-11-05T19:44:11+00:00","modified_at":"2026-11-05T19:44:11+00:00","first_seen_at":"2026-11-05T19:44:11+00:00","fetched_at":"2026-11-05T19:44:11+00:00","note":"Vendor v6 release notes confirm 6.7.0 stops caching secrets in web-accessible file; 5.13.0 fix and details (hashed filename, rotation) from mySites.guru only, so fix verified on 6.7.0 statement. Vendor gives no CVE/first affected version; no exploitation or PoC seen.","cites":["https://www.jreviews.com/docs/v6/release-notes","https://mysites.guru/blog/jreviews-6-7-0-security-release/"]}],"documents":[{"id":79511,"url":"https://www.jreviews.com/docs/v6/release-notes","title":"JReviews v6 release notes (6.7.0 Security)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":79513,"url":"https://mysites.guru/blog/jreviews-6-7-0-security-release/","title":"JReviews 6.7.0 and 5.13.0 Stop Caching Secrets in a Public Folder (mySites.guru)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}