CVE-2026-67361: Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joomla Extension - j2commerce.com (J2Store)to a version that resolves this vulnerability.Fixed in 1.0.0-3.3.20 - Upgrade
Upgrade
Joomla Extension - j2commerce.com (J2Store)to a version that resolves this vulnerability.Fixed in 4.0.0-4.0.20 - Upgrade
Upgrade
Joomla Extension - j2commerce.com (J2Store)to a version that resolves this vulnerability.Fixed in 4.1.0-4.1.5
Event History
Frequently Asked Questions
Which deployments are most exposed?
Fresh installations in the affected J2Store version ranges are specifically exposed because the installer manifest did not place .htaccess or web.config protections in the upload and invoices directories. Uploaded files could therefore be directly accessible over the web.
What does an attacker need to exploit this issue?
An attacker can send a POST request to the upload endpoint without authentication or a CSRF token. No logged-in Joomla or J2Store account is described as necessary.
How can I determine whether an installation may be affected?
Check whether the installed J2Store version falls within 1.0.0 through 3.3.20, 4.0.0 through 4.0.20, or 4.1.0 through 4.1.5. Also inspect the upload and invoices directories for missing .htaccess or web.config protection, particularly on fresh installs.