Affected versions: < 5.13.0
Full advisory: our disclosure post
CVE-2026-117551HighAdded to mySites.guru 4 November 2026
JReviews (com_jreviews) below 5.13.0 and 6.x below 6.7.0 - Unauthenticated Disclosure of Secret Configuration Values from a Web-Accessible Cache File
JReviews before 5.13.0 (and the 6.x line before 6.7.0) caches its whole configuration table as a plain serialized file under components/com_s2framework/tmp/cache/ inside the web root, with no PHP guard and no .htaccess protection. The cached values include the site's Joomla secret (copied into the cms_secret setting), the JReviews cron secret and any third-party API keys configured in JReviews (maps, media storage, CAPTCHA, social). The file name includes a hash derived from the Joomla secret, so it is not blindly guessable, but anyone who learns it (directory listing, a leaked sibling cache file name, a backup, or another file-read flaw) can download it without logging in. The Joomla CNA assigned CVE-2026-117551 on 5 November 2026; until the record publishes, severity is the mySites.guru CVSS 4.0 assessment (8.2, AV:N/AC:L/AT:P/PR:N/UI:N/VC:H). Fixed by ClickFWD in 5.13.0 and 6.7.0 (4 November 2026). The 4.x and older lines have no fixed release: upgrade to a supported line. After updating, clear the JReviews cache so the old file is removed, then rotate the Joomla secret, the JReviews cron secret and any API keys stored in JReviews.
Is my site affected?
CVE-2026-117551 is checked by 2 rules. Find the extension and release line your site runs:
How severe CVE-2026-117551 is
The published CVE record has no CVSS score, so there is no vector to break down here. mySites.guru rates it High, and that is the rating your sites are checked against.
Timeline
- 4 November 2026mySites.guru check added for JReviews (before 5.13.0)
- 4 November 2026mySites.guru check added for JReviews (from 6.0.0 up to but not including 6.7.0)
- 5 November 2026We published: JReviews 6.7.0 and 5.13.0 Stop Caching Secrets in a Public Folder
Rule details
JReviews - JReviews (com_jreviews) below 5.13.0 and 6.x below 6.7.0 - Unauthenticated Disclosure of Secret Configuration Values from a Web-Accessible Cache File
JReviews 6.x before 6.7.0 (and every release before 5.13.0) caches its whole configuration table as a plain serialized file under components/com_s2framework/tmp/cache/ inside the web root, with no PHP guard and no .htaccess protection. The cached values include the site's Joomla secret (copied into the cms_secret setting), the JReviews cron secret and any third-party API keys configured in JReviews (maps, media storage, CAPTCHA, social). The file name includes a hash derived from the Joomla secret, so it is not blindly guessable, but anyone who learns it (directory listing, a leaked sibling cache file name, a backup, or another file-read flaw) can download it without logging in. The Joomla CNA assigned CVE-2026-117551 on 5 November 2026; until the record publishes, severity is the mySites.guru CVSS 4.0 assessment (8.2, AV:N/AC:L/AT:P/PR:N/UI:N/VC:H). Fixed by ClickFWD in 6.7.0 (4 November 2026). After updating, clear the JReviews cache so the old file is removed, then rotate the Joomla secret, the JReviews cron secret and any API keys stored in JReviews.
Affected versions: ≥ 6.0.0 and < 6.7.0
Full advisory: our disclosure post
Our disclosure post
Other vulnerabilities in JReviews
Updating for CVE-2026-117551 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.
References
- CVE-2026-117551 on cve.org (the official CVE record)
- CVE-2026-117551 in the NIST National Vulnerability Database
- JReviews 6.7.0 and 5.13.0 Stop Caching Secrets in a Public Folder
CVE-2026-117551 questions
Which versions are affected by CVE-2026-117551?
CVE-2026-117551 is covered by 2 rules: JReviews before 5.13.0; JReviews from 6.0.0 up to but not including 6.7.0.
How do I fix CVE-2026-117551?
It depends on the extension and release line your site runs. For JReviews before 5.13.0: update JReviews to 5.13.0 or later. For JReviews from 6.0.0 up to but not including 6.7.0: update JReviews to 6.7.0 or later.
How severe is CVE-2026-117551?
The published CVE record has no CVSS score. mySites.guru rates it High.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 5 November 2026.