CVE-2026-118494

{
  "etk_id": "ETK-2026-3671",
  "cve_id": "CVE-2026-118494",
  "display_id": "CVE-2026-118494",
  "ghsa_id": "GHSA-55p7-x368-5pg2",
  "euvd_id": "EUVD-2026-117630",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Web-accessible secret cache in JReviews for Joomla",
  "summary": "JReviews 1.0.0–5.12.0 and 6.0.0–6.6.9 can place Joomla configuration secrets and external-service credentials in a cache directory beneath the web root. An unauthenticated attacker may retrieve the cached data when the cache file is reachable and its name is known.",
  "mitigation": "Block web requests to the JReviews cache directory, remove any exposed cached configuration files, and rotate Joomla and third-party secrets that may have been stored there. No fixed version is recorded; restrict access at the web-server layer until a vendor update is available.",
  "vendor": "jreviews.com",
  "product": "JReviews component for Joomla",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "6.0.0-6.6.9",
        "1.0.0-5.12.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "com_jreviews",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": 0.0047,
  "epss_percentile": 0.406,
  "epss_asof": "2026-11-06",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 20.078325033333332,
  "t0_at": "2026-11-05T18:02:09.401000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-05T22:18:47.300956+00:00",
      "days": 0.17821643467592593,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T18:02:09.401000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-05T18:02:09.401000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T18:02:09.401000+00:00",
      "url": "https://github.com/advisories/GHSA-55p7-x368-5pg2"
    }
  }
}