CVE-2026-67362: Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
j2commerce.com/J2Storeto a version that resolves this vulnerability.Fixed in 1.0.0-3.3.20 - Upgrade
Upgrade
j2commerce.com/J2Storeto a version that resolves this vulnerability.Fixed in 4.0.0-4.0.20 - Upgrade
Upgrade
j2commerce.com/J2Storeto a version that resolves this vulnerability.Fixed in 4.1.0-4.1.5
Event History
Frequently Asked Questions
Which deployments are affected?
J2Store versions 1.0.0 through 3.3.20, 4.0.0 through 4.0.20, and 4.1.0 through 4.1.5 are affected.
Does exploitation require an authenticated Joomla or store account?
No. The vulnerable cart-controller task handlers can be exploited without authentication.
What does an attacker need to supply to trigger the redirect?
An attacker needs to provide a base64-encoded URL through user-controlled input accepted by one of the four affected task handlers. The destination host is not validated before the redirect occurs.
What is the practical impact?
An attacker can use the trusted shop domain as part of a phishing flow by causing visitors to be redirected to an attacker-controlled destination.