Skip to main content
mySites.guru
Free Audit
NewmySites.guru is now a Cloudflare verified serviceWhat it means for your sites

JReviews security vulnerabilities

mySites.guru tracks 2 vulnerabilities in JReviews (com_jreviews), covering 2 CVEs. Every connected Joomla site is checked against them on each audit.

Is my site affected?

Your site is affected if it runs JReviews in any of these ranges:

  • from 6.0.0 up to but not including 6.7.0
  • before 5.13.0
Latest safe version
6.7.0 or later. No rule we check matches that release or any newer one.
What to do
Update JReviews to 6.7.0 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Check whether your sites are affected

Every JReviews vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
CVE-2026-117551before 5.13.05.13.0High2026-11-04
CVE-2026-117551CVE-2026-118494CVSS 8.2from 6.0.0 up to but not including 6.7.06.7.0High2026-11-04

What we check for

HighCVE-2026-1175512026-11-04

JReviews (com_jreviews) below 5.13.0 and 6.x below 6.7.0 - Unauthenticated Disclosure of Secret Configuration Values from a Web-Accessible Cache File

JReviews before 5.13.0 (and the 6.x line before 6.7.0) caches its whole configuration table as a plain serialized file under components/com_s2framework/tmp/cache/ inside the web root, with no PHP guard and no .htaccess protection. The cached values include the site's Joomla secret (copied into the cms_secret setting), the JReviews cron secret and any third-party API keys configured in JReviews (maps, media storage, CAPTCHA, social). The file name includes a hash derived from the Joomla secret, so it is not blindly guessable, but anyone who learns it (directory listing, a leaked sibling cache file name, a backup, or another file-read flaw) can download it without logging in. The Joomla CNA assigned CVE-2026-117551 on 5 November 2026; until the record publishes, severity is the mySites.guru CVSS 4.0 assessment (8.2, AV:N/AC:L/AT:P/PR:N/UI:N/VC:H). Fixed by ClickFWD in 5.13.0 and 6.7.0 (4 November 2026). The 4.x and older lines have no fixed release: upgrade to a supported line. After updating, clear the JReviews cache so the old file is removed, then rotate the Joomla secret, the JReviews cron secret and any API keys stored in JReviews.

Affected versions: < 5.13.0

Full advisory: our disclosure post

HighCVE-2026-117551CVE-2026-1184942026-11-04

JReviews (com_jreviews) below 5.13.0 and 6.x below 6.7.0 - Unauthenticated Disclosure of Secret Configuration Values from a Web-Accessible Cache File

JReviews 6.x before 6.7.0 (and every release before 5.13.0) caches its whole configuration table as a plain serialized file under components/com_s2framework/tmp/cache/ inside the web root, with no PHP guard and no .htaccess protection. The cached values include the site's Joomla secret (copied into the cms_secret setting), the JReviews cron secret and any third-party API keys configured in JReviews (maps, media storage, CAPTCHA, social). The file name includes a hash derived from the Joomla secret, so it is not blindly guessable, but anyone who learns it (directory listing, a leaked sibling cache file name, a backup, or another file-read flaw) can download it without logging in. The Joomla CNA assigned CVE-2026-117551 on 5 November 2026; until the record publishes, severity is the mySites.guru CVSS 4.0 assessment (8.2, AV:N/AC:L/AT:P/PR:N/UI:N/VC:H). Fixed by ClickFWD in 6.7.0 (4 November 2026). After updating, clear the JReviews cache so the old file is removed, then rotate the Joomla secret, the JReviews cron secret and any API keys stored in JReviews.

Affected versions: ≥ 6.0.0 and < 6.7.0

Full advisory: our disclosure post

Timeline

  1. 4 November 2026Check added for CVE-2026-117551 (before 5.13.0)
  2. 4 November 2026Check added for CVE-2026-117551 and CVE-2026-118494 (from 6.0.0 up to but not including 6.7.0)
  3. 5 November 2026CVE-2026-118494 record published
  4. 5 November 2026We published: JReviews 6.7.0 and 5.13.0 Stop Caching Secrets in a Public Folder

What we have written about JReviews

JReviews 6.7.0 and 5.13.0 Stop Caching Secrets in a Public Folder

JReviews 6.7.0 and 5.13.0 Stop Caching Secrets in a Public Folder

JReviews 6.7.0 and 5.13.0 stop writing the Joomla secret and API keys to a web-accessible cache file. What was exposed, who is affected and what to rotate.

References

Each CVE page above links its official cve.org record and its NVD entry.

JReviews vulnerability questions

Which versions of JReviews are vulnerable?
mySites.guru tracks 2 vulnerabilities in JReviews (com_jreviews). A site is affected if its installed version is in any of these ranges: from 6.0.0 up to but not including 6.7.0; before 5.13.0.
What is the latest safe version of JReviews?
6.7.0. Every vulnerability tracked here is fixed by 6.7.0, and no rule we check matches that release or any later one.
How do I check which version of JReviews my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com_jreviews. mySites.guru reads the installed version on every audit of a connected site and checks it against these rules.

Running JReviews on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

CVE identifiers: CVE-2026-117551, CVE-2026-118494. Rules current as of 5 November 2026.