Executive brief
J2Store is a Joomla eCommerce extension that handles digital product downloads for customers. A flaw in the download system allows customers who hold a valid download token to read arbitrary files from the web server (such as database configuration files), bypassing the intended folder restriction. This exposes sensitive configuration and credentials stored on the server.
Technical details
The vulnerability exists in J2StoreModelOrderdownloads::getFilePath(), which constructs file paths by concatenating a configured attachment folder with a product file's stored name using only JPath::clean() and JFile::exists() checks. JPath::clean() normalizes path separators but does not resolve or reject directory traversal sequences (../ segments). An attacker with a valid download token and product ID can supply a crafted product_file_save_name containing ../ traversal sequences to escape the attachment folder and read any file accessible to the web server process, such as configuration.php containing database credentials. The traversal could be introduced through CSRF-forgeable admin product-file actions or other integration points. No evidence of wild exploitation has been reported.
Affected products
- J2Commerce J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Timeline
- 2026-09-15: disclosed