Executive brief
J2Store is a popular eCommerce extension for Joomla websites. The extension contains an unauthenticated file upload vulnerability where visitors can upload files without authentication or CSRF protection. Additionally, the installer fails to protect uploaded files with proper access controls, making them directly accessible via the web and potentially exposing sensitive data or allowing attackers to execute malicious code.
Technical details
The vulnerability is a combination of an unauthenticated file upload endpoint and missing directory protection. The file upload endpoint accepts POST requests from unauthenticated users with no CSRF token validation. The installer manifest omits the upload and invoices directories from its configuration, causing fresh installations to deploy these directories without .htaccess or web.config protection rules. This allows uploaded files to be directly web-accessible and potentially executable, enabling remote code execution or arbitrary file disclosure depending on server configuration and file types accepted.
Affected products
- J2Commerce J2Store 1.0.0–3.3.20, 4.0.0–4.0.20, 4.1.0–4.1.5
Timeline
- 2026-08-21: disclosed