Security
JReviews fixes web-accessible cache secret disclosure
ClickFWD has fixed a high-severity information disclosure flaw in JReviews that could expose Joomla secrets and stored API keys through a web-accessible cache file.
The issue, tracked as CVE-2026-118494, affects JReviews releases below 5.13.0 in the v5 series and below 6.7.0 in the v6 series. The affected Joomla extension is developed by ClickFWD LLC.
mySites.guru reports that the cached configuration could contain the Joomla secret, JReviews cron secret and credentials for services including maps, cloud storage, CAPTCHA and social platforms. The file could be downloaded without authentication if its name was known. The Joomla CNA rates the vulnerability 8.2 High under CVSS 4.0. The advisory says ClickFWD provided no information about exploitation, and no exploitation status was reported.
- Update to JReviews
6.7.0or5.13.0, as appropriate. - Clear the JReviews cache and remove any remaining files containing
jreviews_config. - Block web access to
components/com_s2framework/tmp/. - If exposure is possible, rotate the Joomla secret, JReviews cron secret and third-party credentials stored by the extension.
The unsupported 4.x line, including 4.6.6 and older releases, has no listed fix.
Originally reported by mySites.guru.