---
id: "CVE-2026-118494"
kind: "vulnerability"
aliases: ["CVE-2026-118494"]
title: "JReviews Joomla extension: cached settings file exposes secrets to anyone"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "com_jreviews", "fixed": ["5.13.0", "6.7.0"], "affected": ">= 1.0.0, <= 5.12.0; >= 6.0.0, <= 6.6.9", "ecosystem": "joomla"}]
ecosystems: []
tags: ["joomla", "jreviews", "package", "php", "self-hosted"]
not_affected_if: ["fixed-version", "versions-outside-range", "web-server-blocks-cache-dir", "wordpress-plugin"]
published_at: "2026-11-05T19:17:12+00:00"
first_seen_at: "2026-11-05T19:40:35+00:00"
updated_at: "2026-11-05T19:44:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118494", "first_seen_at": "2026-11-05T19:40:35+00:00"}, {"source": "analyst", "url": "https://mysites.guru/blog/jreviews-6-7-0-security-release/", "first_seen_at": "2026-11-05T19:44:11+00:00", "cites": ["https://mysites.guru/blog/jreviews-6-7-0-security-release/", "https://www.jreviews.com/docs/v6/release-notes"]}]
exploit_sources: []
---

# JReviews Joomla extension: cached settings file exposes secrets to anyone

JReviews writes its full settings table, including the Joomla global secret and third-party API keys, to a serialized cache file inside the public web root. Anyone who knows the file name can read those secrets without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- joomla:com_jreviews affected >= 1.0.0, <= 5.12.0; >= 6.0.0, <= 6.6.9 fixed 5.13.0, 6.7.0

## How to check

- Check the installed JReviews version in Joomla admin: Extensions > Manage. Affected: 6.0.0-6.6.x and 5.x below 5.13.0 (and older lines, 4.x has no fix).
- Look in components/com_s2framework/tmp/cache/core/ under the web root for files with jreviews_config in the name; if present, test whether they download over HTTP. The file name ends in a hash that includes the Joomla secret, so it is only reachable if the name leaks (directory listing, backup, logs, another file-read flaw).
- Also check whether directory listing is on for that folder.

## Fix

Update JReviews to 6.7.0 (v6 line) and install the matching S2Framework 6.7.0 update; the vendor's 6.7.0 Security note says it stops caching secret configuration values in a web-accessible file. The v5 line is reported fixed in 5.13.0 by mySites.guru (vendor v5 notes not read). After updating, clear the JReviews cache and delete any leftover jreviews_config cache file, then rotate the Joomla secret, cron secret and third-party API keys if the file could have been reached.

## Timeline

- 2026-11-05T19:40:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118494
- 2026-11-05T19:44:11+00:00 analyst https://mysites.guru/blog/jreviews-6-7-0-security-release/ — Vendor v6 release notes confirm 6.7.0 stops caching secrets in web-accessible file; 5.13.0 fix and details (hashed filename, rotation) from mySites.guru only, so fix verified on 6.7.0 statement. Vendor gives no CVE/first affected version; no exploitation or PoC seen.

## Documents

- [describes] JReviews 6.7.0 and 5.13.0 Stop Caching Secrets in a Public Folder (mySites.guru) https://mysites.guru/blog/jreviews-6-7-0-security-release/
- [fix] JReviews v6 release notes (6.7.0 Security) https://www.jreviews.com/docs/v6/release-notes

## From the sources

Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 - JReviews caches its full settings table, including the Joomla global configuration secret (copied into cms_secret) and third-party API keys and secrets, to a serialized file under components/com_s2framework/tmp/cache/core/ inside the web root. The file has no PHP guard and the directory has no .htaccess, so anyone who knows the file name can read it without authentication.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_