CVE-2026-81568: Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Joomla Extension - j2commerce.com - Arbitrary file read via task=download in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - J2StoreModelOrderdownloads::getFilePath() built the on-disk path to a purchased digital download by concatenating the configured attachment folder with the product file's stored productfilesavename, using only JPath::clean() (which normalises separators but does not resolve or reject .. segments) and a plain JFile::exists() check — never confirming the resolved path stayed inside the configured attachment folder. If a product file's productfilesavename ever contained a ../ traversal segment — most plausibly via the CSRF-forgeable admin product-file save actions described in Issue 1, but equally by any future integration or bug that writes that field — any customer holding a valid download token/pid pair for that product file could have the traversal resolve to a path outside the attachment folder and download any file readable by the web server (e.g. configuration.php).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update getFilePath() to ensure the built on-disk path (attachment folder + stored product_file_save_name) cannot escape the attachment folder—i.e., add logic to reject/neutralize any traversal segments such as '../' and verify the resolved path remains inside the attachment folder before allowing task=download.
J2StoreModelOrderdownloads::getFilePath() product_file_save_name path handling = Reject or resolve paths that contain '..' so the final resolved path must stay within the configured attachment folder (not just JPath::clean())
Event History
Frequently Asked Questions
Which installations are affected?
Affected versions are J2Store 1.0.0 through 3.3.2, 4.0.0 through 4.0.22, and 4.1.0 through 4.1.7. The issue applies where a product file's stored product_file_save_name contains a ../ traversal segment.
What does an attacker need to read files outside the attachment folder?
The attacker needs a valid download token and pid pair for the affected product file. They also need that product file's stored filename to contain traversal segments, which could be introduced through CSRF-forgeable administrator product-file save actions or another integration or bug that writes the field.
What files could be exposed?
Any file readable by the web server may be downloadable if traversal resolves outside the configured attachment folder. The advisory specifically identifies Joomla's configuration.php as an example.
How can I determine whether I am exposed?
Review stored product_file_save_name values for ../ or other traversal segments, especially for digital products. Also investigate product-file changes that could have been made through forged administrator save actions.