CVE-2026-67361

Received Received - Intake

Unauthenticated File Upload in J2Store Joomla Extension

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: Joomla! Project

Description

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-67361

EUVD

EUVD-2026-64064

Affected Vendors & Products

Vendor	Product	Version / Range
j2commerce	j2store	From 1.0.0 (inc) to 3.3.20 (inc)
j2commerce	j2store	From 4.0.0 (inc) to 4.0.20 (inc)
j2commerce	j2store	From 4.1.0 (inc) to 4.1.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-538	The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Attack-Flow Graph

Executive Summary

This is an unauthenticated file upload vulnerability in the J2Store Joomla extension versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5. The vulnerability allows unauthenticated users to upload files via a POST request without requiring a CSRF token. Additionally, the installer manifest did not include the upload and invoices directories, which meant fresh installations deployed these directories without proper .htaccess or web.config protection, making uploaded files directly accessible via the web.

Detection Guidance

Check for unauthorized file uploads in the J2Store upload and invoices directories. Look for unexpected files in web-accessible paths like /components/com_j2store/upload/ or /components/com_j2store/invoices/. Use commands like 'find /path/to/webroot -type f -name "*.php" -o -name "*.exe"' to search for suspicious files.

Impact Analysis

An attacker could exploit this vulnerability to upload malicious files to your server, potentially leading to remote code execution, defacement of your website, or theft of sensitive data. Since the uploaded files are directly web-accessible, the attacker could serve malicious content to visitors or use the server for further attacks.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR and HIPAA requirements for protecting personal and health information. Non-compliance with these regulations can result in significant fines and legal consequences.

Mitigation Strategies

Update J2Store to the latest patched version. Remove write permissions from the upload and invoices directories. Add .htaccess or web.config files to restrict access to these directories. Block POST requests to the vulnerable endpoint if possible.

Hi! I’m here to help you understand CVE-2026-67361. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70