# CVE-2026-67361: J2Store unauthenticated file upload with missing directory protection

Source: https://junglewise.ai/threats/cve-2026-67361-j2store-unauthenticated-file-upload-with-missing-directory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67361 · Severity: info · Published 2026-08-21

J2Store is a popular eCommerce extension for Joomla websites. The extension contains an unauthenticated file upload vulnerability where visitors can upload files without authentication or CSRF protection. Additionally, the installer fails to protect uploaded files with proper access controls, making them directly accessible via the web and potentially exposing sensitive data or allowing attackers to execute malicious code.

## Quick answers

**Is CVE-2026-67361 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67361 being exploited in the wild.

**How severe is CVE-2026-67361?** Informational severity, published 21 August 2026.

**Which products and versions are affected?** J2Commerce J2Store 1.0.0–3.3.20, 4.0.0–4.0.20, 4.1.0–4.1.5.

**Is there a fix for CVE-2026-67361?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-67361 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-67361?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a combination of an unauthenticated file upload endpoint and missing directory protection. The file upload endpoint accepts POST requests from unauthenticated users with no CSRF token validation. The installer manifest omits the upload and invoices directories from its configuration, causing fresh installations to deploy these directories without .htaccess or web.config protection rules. This allows uploaded files to be directly web-accessible and potentially executable, enabling remote code execution or arbitrary file disclosure depending on server configuration and file types accepted.

## Affected products

- J2Commerce J2Store 1.0.0–3.3.20, 4.0.0–4.0.20, 4.1.0–4.1.5

## Timeline

- 2026-08-21: disclosed

## References

- [https://www.j2commerce.com/](https://www.j2commerce.com/)