JCH Optimize: Six High-Severity Vulnerabilities — Update to Version 9.4.1

On October 7, 2026, the developer of the popular website performance extension JCH Optimize released a major security update. Version 9.4.0 addressed six high-severity vulnerabilities, including cross-site scripting, an unsafe publicly accessible Page Cache endpoint, missing permission checks in administrator tasks, and an open redirect.

JCH Optimize 9.4.1 was released later the same day to fix a critical error introduced by version 9.4.0 on websites using Redis or APCu for cache storage. Website owners should therefore update directly to version 9.4.1 or later.

The vulnerabilities affect both the Free and Pro editions of JCH Optimize. Some issues could be exploited by unauthenticated visitors, while others required access to the administrator area or interaction from a logged-in administrator who opened a specially crafted link.

What Is JCH Optimize?

JCH Optimize is a third-party Joomla extension designed to improve website performance. It processes the final HTML output, combines and minifies CSS and JavaScript, optimizes images, manages resource preloading, and can store complete pages in its own page cache.

Because the extension modifies the HTML output of almost every page before it is sent to the visitor, errors in its processing logic can affect the entire website, even when Joomla and other extensions originally generated safe markup.

Understanding the Threat: What Was Fixed?

The JCH Optimize 9.4.0 changelog identifies six fixes as HIGH. The release also includes several additional Medium- and Low-severity fixes.

At the time of publication, these vulnerabilities have not been assigned individual CVE identifiers. Website owners should therefore use the extension name and installed version to determine whether their websites are affected.

Cross-Site Scripting During URL Optimization

The most concerning issue for publicly accessible websites was related to the processing of encoded characters in URLs. Joomla or another extension could correctly escape a search query added to a link, but JCH Optimize could decode those characters again while optimizing the page.

As a result, a previously safe value could be converted into active HTML or JavaScript code. To exploit the issue, an attacker only needed to prepare a specially crafted link, such as a search page URL, and convince a visitor or administrator to open it.

The malicious JavaScript would run in the context of the affected website and could potentially be used to:

• modify the content of the page;
• redirect the visitor to a fraudulent or malicious website;
• display a fake login form;
• perform actions on behalf of an authenticated user;
• access information and tokens available to the browser.

Unsafe Page Cache Hit Counter Endpoint

When JCH Optimize serves a page from its own cache, Joomla does not run the component that originally generated that page. As a result, the standard hit counters for articles and other content would not normally increase.

To solve this problem, the Page Cache plugin added a request to a publicly accessible com_ajax endpoint. The endpoint accepted a component name, model name, and item ID from the request, then loaded the specified model and called its hit() method.

Before version 9.4.0, an unauthenticated visitor could choose which component and model the endpoint would load. This made it possible to manipulate hit counters for arbitrary items, including unpublished content and items protected by access levels.

The developer has not stated that this endpoint could call arbitrary methods or execute PHP code. The confirmed vulnerability was limited to unsafe model selection and invocation of the hit() method.

In the fixed version, only a predefined list of supported content types is permitted:

• articles;
• categories;
• contacts;
• news feeds;
• tags.

Before increasing the hit counter, JCH Optimize now also verifies that the item is published and accessible to the current visitor.

Administrator Tasks Ran Without a Token or the Required Permissions

Before JCH Optimize 9.4.0, the extension’s administrator dispatcher did not consistently verify a CSRF token or require the core.admin permission for tasks that modified settings or files.

This created two main attack scenarios:

• CSRF attack: A logged-in administrator could open a specially crafted link or page, causing the browser to submit a request that changed settings or performed a file operation without the administrator’s informed consent.
• Insufficient permission checks: A lower-privileged backend user could perform operations that should have required administrator-level access.

Starting with version 9.4.0, all administrator tasks that modify settings or files require a valid Joomla form token and the core.admin permission for the JCH Optimize component.

Open Redirect Through the return Parameter

The Mode Switcher and Utility tasks used a return parameter to redirect the user after completing an operation. The destination was provided in an encoded form, but the extension did not sufficiently verify that it belonged to the current website.

An attacker could prepare a link that redirected a logged-in administrator to an external website. This could be used in phishing attacks, for example to display a fake reauthentication page.

The fixed version only permits internal URLs belonging to the current website.

Insufficient Validation of Optimized Image Paths

The image optimization service returns URLs and file paths for processed images. Earlier JCH Optimize versions did not validate these values strictly enough.

Version 9.4.0 adds validation for returned URLs and file paths. Image directories must now remain inside the website root, preventing the extension from working with unintended paths outside it.

The jchbackend Parameter Disabled Optimization for Any Visitor

Before the fix, adding the jchbackend=1 parameter to a page URL caused JCH Optimize to skip optimization for that request. Any visitor could use this parameter without authentication.

This did not provide direct access to the administrator panel or website files, but it allowed an external user to alter the extension’s behavior and bypass the optimized output. The parameter has been removed in JCH Optimize 9.4.0.

Additional Security Fixes

In addition to the six high-severity issues, the developer introduced several other security-related improvements:

• File and folder escaping: File and directory names are now safely escaped in the Optimize Images file tree.
• Host header validation: Malformed Host headers can no longer affect detection of the current page URL.
• Page Cache key protection: Malformed hostnames, unsafe characters, and dangerous path segments are rejected in Page Cache and Capture Cache keys.
• Cache ID validation: Page Cache IDs are now validated before cached pages are deleted.
• Fixed jchnooptimize parameter: The jchnooptimize parameter now correctly disables optimization.
• Updated libraries: Bundled libraries, including Symfony DomCrawler, Guzzle, and Laminas, have been updated to current stable releases.

Protection of the Cloudflare API Token and Redis Password

In earlier versions, a JCH Optimize settings export could contain the Cloudflare API token and Redis password. If such a file was shared with technical support, saved in a publicly accessible folder, or obtained by an unauthorized person, the credentials could be exposed.

In the new version:

• settings exports no longer include the Cloudflare API token or Redis password;
• export files are downloaded directly;
• when settings are imported, the website’s existing token and password are preserved if they are not present in the imported file.

Why Should You Install 9.4.1 Instead of 9.4.0?

JCH Optimize 9.4.0 includes all the security fixes described above, but it also introduced a new critical error for websites using Redis or APCu as the cache storage adapter.

Several classes from the updated Laminas Cache library were missing from the 9.4.0 package. As a result, websites using JCH Optimize Pro with Redis or APCu could encounter a fatal PHP error on every page and become completely unavailable.

JCH Optimize 9.4.1 was released later the same day and restored the missing classes. It includes:

• all security fixes from version 9.4.0;
• a fix for the Redis fatal error;
• a fix for the APCu fatal error.

Who Is at Risk?

All website owners running JCH Optimize Free or Pro below version 9.4.0 should update the extension.

The recommended versions and requirements for current websites are:

• Joomla 5 and Joomla 6: JCH Optimize 9.4.1 or later.
• PHP: version 8.1 or later.

The official release description lists Joomla 5.0 as the minimum requirement, while the download page also lists compatibility with Joomla 4.4. Joomla 4.4 website owners should create a backup and test the update on a copy of the website first.

How to Resolve the Problem: Step-by-Step Instructions

Step 1: Create a Backup

Before updating, create a complete backup of the Joomla files and database. If Redis or APCu is being used, make sure you install version 9.4.1 or later.

Step 2: Update JCH Optimize

1. In the Joomla administrator panel, go to System → Update → Extensions.
2. Click “Check for Updates”.
3. Find JCH Optimize in the list.
4. Install version 9.4.1 or later.
5. After installation, open System → Manage → Extensions.
6. Make sure the component and all related JCH Optimize plugins have been updated to the same version.

Step 3: Clear the Cache and Test the Website

1. Clear the JCH Optimize cache.
2. Clear the Joomla system cache.
3. If a CDN is being used, purge its cache.
4. Test the home page, articles, search, forms, and pages containing URL parameters.
5. Check CSS and JavaScript combination and minification.
6. Check image optimization and WebP/AVIF generation.
7. Check Page Cache and hit counter updates.
8. If you use the Pro edition, test Redis or APCu cache storage.

If the website became unavailable after installing version 9.4.0 because of the Redis or APCu error, update the extension manually to version 9.4.1. As a temporary workaround, you can change the Storage Adapter to Filesystem.

If neither the website nor the administrator panel is accessible, temporarily renaming the /plugins/system/jchoptimize and /plugins/system/jchpagecache directories through FTP or a hosting file manager will disable the affected plugins. After access has been restored, install the latest version and restore the correct directory names.

Step 4: Check for Possible Signs of Exploitation

At the time of publication, there is no confirmed evidence of widespread exploitation of these vulnerabilities in real-world attacks. However, installing the update does not reverse actions that may have been performed previously.

1. Check user accounts: Look for unknown users and unexpected assignments to the Administrator and Super Users groups.
2. Check JCH Optimize settings: Look for unfamiliar changes to optimization, CDN, Page Cache, and image processing settings.
3. Check old exports: Delete JCH Optimize settings files from download folders, backups, support tickets, and publicly accessible directories.
4. Check the logs: Look for suspicious requests to com_ajax, the Page Cache plugin, and JCH Optimize administrator tasks.
5. Check redirects: Look for unfamiliar links containing a return parameter and requests to Mode Switcher or Utility tasks.
6. Check website files: Look for recently created or modified PHP files in the website root and in /administrator, /plugins, /components, /templates, /images, and /media.

Step 5: Additional Security Measures

• Restrict access to JCH Optimize: Only trusted administrators should be allowed to configure the extension.
• Enable multi-factor authentication for all administrator accounts.
• Update Joomla and all other extensions to their latest compatible versions.
• Do not store settings exports in publicly accessible directories or send them through insecure communication channels.
• Configure a Web Application Firewall: A WAF may reduce the likelihood of successful XSS and CSRF attacks, but it does not replace installing the update.
• Create regular backups and keep at least one current backup outside the website server.

We Can Handle Everything for You

If the steps described above seem too complicated, if you simply do not want to spend your time dealing with them, or if you would like to save money on commercial extensions, we are ready to help:

• update JCH Optimize and check its configuration;
• update your website to the latest Joomla version together with all installed extensions;
• audit the installed extensions and remove any that are no longer needed;
• check the website for malicious code and hidden user accounts;
• configure website backups, including backups to remote storage;
• install licensed versions of popular extensions on your website;
• protect the website with additional security measures;
• take ongoing care of the website by regularly updating Joomla and its extensions, including commercial ones.

Submit a request List of services