Read the docs
TI-2026-85574 Aliases CVE-2026-118494GHSA-55p7-x368-5pg2

Joomla JReviews caches secrets in a web-accessible file

Priority LOW 36CWE-538Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The JReviews component for Joomla, versions 1.0.0-5.12.0 and 6.0.0-6.6.9, caches its full settings table to a serialized file in the web root. That file holds the Joomla global configuration secret and third-party API keys and secrets, so sensitive information is written into an externally accessible file (CWE-538). The file has no PHP guard and its directory has no .htaccess, so an unauthenticated remote attacker who knows the file name can read the secrets.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 - JReviews caches its full settings table, including the Joomla global configuration secret (copied into cms_secret) and third-party API keys and secrets, to a serialized file under components/com_s2framework/tmp/cache/core/ inside the web root. The file has no PHP guard and the directory has no .htaccess, so anyone who knows the file name can read it without authentication.

Why it matters now

EPSS 0.00467 40th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
jreviews.comJReviews component for Joomla6.0.0-6.6.9; 1.0.0-5.12.0—No fix listedCNA
  • JReviews component for Joomla Vendorjreviews.com Affected 6.0.0-6.6.9; 1.0.0-5.12.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for JReviews component for Joomla.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-118494
  2. 2026-11-05 Alias added: GHSA-55p7-x368-5pg2
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat
  5. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences