CVE-2026-118494
Received Received - Intake

Secret Configs Cached in Web-Accessible File in JReviews

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Joomla! Project

Description
Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 - JReviews caches its full settings table, including the Joomla global configuration secret (copied into cms_secret) and third-party API keys and secrets, to a serialized file under components/com_s2framework/tmp/cache/core/ inside the web root. The file has no PHP guard and the directory has no .htaccess, so anyone who knows the file name can read it without authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-06
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-118494
EUVD
EUVD-2026-117630

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jreviews.com JReviews component for Joomla 6.0.0-6.6.9
jreviews.com JReviews component for Joomla 1.0.0-5.12.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-538 The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the JReviews Joomla extension caching sensitive configuration data, including Joomla global secrets and third-party API keys, in a web-accessible file. The file is stored without PHP protection or .htaccess restrictions, allowing unauthenticated access if the filename is known.

Detection Guidance

Check for the existence of the file components/com_s2framework/tmp/cache/core/ inside your Joomla web root. If present, inspect it for serialized data containing sensitive configurations like cms_secret or API keys. Use commands like 'find /path/to/joomla -name core -type d' to locate the directory and 'ls -la components/com_s2framework/tmp/cache/core/' to check for the file.

Impact Analysis

An attacker could access the cached file to obtain secret keys, API credentials, or Joomla configuration details. This could lead to unauthorized access, data breaches, or compromise of third-party services integrated with JReviews.

Compliance Impact

This vulnerability could result in unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) requirements. Exposure of API keys or secrets may also breach compliance obligations for data security and confidentiality.

Mitigation Strategies

Immediately delete the cached file components/com_s2framework/tmp/cache/core/ if it exists. Ensure the directory components/com_s2framework/tmp/cache/core/ has proper access restrictions and an .htaccess file to block direct web access. Update JReviews to the latest patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118494. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...