Skip to main content
mySites.guru
Free Audit
New this monthDJ-HelpfulArticlesGridbox SQLiVik BookingPhoca Download CSRFStageItModSecurity SavesCmd+K Search

JCH Optimize security vulnerabilities

mySites.guru tracks 2 vulnerabilities in JCH Optimize (com_jchoptimize). Every connected Joomla site is checked against them on each audit.

Is my site affected?

Your site is affected if it runs JCH Optimize in any of these ranges:

  • before 9.4.2
  • before 9.4.0
Latest safe version
9.4.2 or later. No rule we check matches that release or any newer one.
What to do
Update JCH Optimize to 9.4.2 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Check whether your sites are affected

Every JCH Optimize vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
No CVE idbefore 9.4.29.4.2High2026-10-10
No CVE idbefore 9.4.09.4.0High2026-10-07

What we check for

High2026-10-10

JCH Optimize (com_jchoptimize) below 9.4.2 - Path Traversal File Read and SSRF When Combining Files, plus Admin XSS

JCH Optimize versions before 9.4.2, including the 9.4.0 and 9.4.1 security releases, contain further flaws fixed in 9.4.2 (10 October 2026). The vendor rates one HIGH: when combining files, CSS and JavaScript files outside the site root could be read through encoded slashes (..%2F) in their URLs, because dot segments were removed before the path was decoded, and the combined file is published to visitors. MEDIUM-rated fixes: combining files fetched files from private network addresses and followed redirects to them (SSRF); cross-site scripting in the Critical JavaScript Configure Helper, which showed script URLs from the site's pages unescaped; settings exports included the Download ID; the request that starts a Recache could be reused; and the .htaccess changes and plugin ordering after an update ran on a visitor's request instead of waiting for an administrator. Page Cache cookies now follow the Global Configuration cookie settings, so logged-in users are no longer served captured guest pages. No CVE has been assigned at the time of writing. The vendor withdrew the first 9.4.2 build (its component reports 9.4.2-dev202610101433-revbbe49222) later on 10 October 2026 and replaced it with a rebuilt 9.4.2 that has identical security fixes, so both builds are treated as fixed; the rebuild also fixes tag pages showing an error page to guests when Page Cache is on. Update to JCH Optimize 9.4.2 or later. 9.4.x requires PHP 8.1 and Joomla 5.0 or later, and the update feed no longer offers it to Joomla 4.4. There is no patched release for older branches.

Affected versions: < 9.4.2

Full advisory: our disclosure post

High2026-10-07

JCH Optimize (com_jchoptimize) below 9.4.0 - Unauthenticated XSS and Page Cache Hit Counter Access Control Bypass, plus Admin CSRF and Open Redirect

JCH Optimize versions before 9.4.0 contain several flaws the vendor rates HIGH. A cross-site scripting issue let encoded characters in URLs, such as search query links, be decoded during optimization. The Page Cache hit counter exposed an unauthenticated com_ajax endpoint that took the component and model names from the request and called that model's hit() method, so any visitor could drive hit counters on content the page cache never served and read back exception messages. A jchbackend URL parameter let any visitor switch optimization off. Administrator tasks that change settings or files did not require a valid form token and administrator permissions (CSRF), the Mode Switcher and Utility tasks redirected to any URL passed in the return parameter, and image URLs and paths returned by the image optimization service were not validated or kept inside the site root. MEDIUM-rated fixes cover unescaped file and folder names in the Optimize Images tree and malformed Host headers influencing Page Cache and Capture Cache keys and file paths. Settings exports no longer include the Cloudflare API token or Redis password. No CVE has been assigned at the time of writing. Update to JCH Optimize 9.4.2, which includes these fixes and a second round fixed on 10 October 2026. The 9.4.x line requires PHP 8.1 and Joomla 5.0 or later. The update feed offered 9.4.x to Joomla 4.4 until 10 October 2026 and now lists Joomla 5.0 and later only, so a Joomla 4.4 site needs its Joomla 5 upgrade before it can get the fix. There is no patched release for older branches.

Affected versions: < 9.4.0

Full advisory: our disclosure post

Timeline

  1. 7 October 2026Check added for a flaw with no CVE id (before 9.4.0)
  2. 10 October 2026Check added for a flaw with no CVE id (before 9.4.2)

References

JCH Optimize vulnerability questions

Which versions of JCH Optimize are vulnerable?
mySites.guru tracks 2 vulnerabilities in JCH Optimize (com_jchoptimize). A site is affected if its installed version is in any of these ranges: before 9.4.2; before 9.4.0.
What is the latest safe version of JCH Optimize?
9.4.2. Every vulnerability tracked here is fixed by 9.4.2, and no rule we check matches that release or any later one.
How do I check which version of JCH Optimize my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com_jchoptimize. mySites.guru reads the installed version on every audit of a connected site and checks it against these rules.

Running JCH Optimize on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

Rules current as of 27 October 2026.