CVE-2026-67361 j2commerce.com CVE debrief

Who should care

Joomla users with J2Store extensions, particularly those with versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 installed, should be aware of this vulnerability and take necessary actions to protect their systems. This includes verifying and applying vendor patches, restricting access to file upload endpoints, and implementing CSRF token validation for file uploads. Security teams should prioritize this vulnerability due to its potential impact on system security and data integrity.

Technical summary

The file upload endpoint in J2Store versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 accepted POST requests from unauthenticated visitors without a CSRF token. Additionally, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible. This vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity.

Defensive priority

Medium priority given the unauthenticated file upload vulnerability with CVSS score of 6.9.

Recommended defensive actions

• Verify and apply vendor patches for J2Store versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5
• Restrict access to file upload endpoints
• Implement CSRF token validation for file uploads
• Ensure .htaccess/web.config protection for upload and invoices directories
• Monitor for suspicious file upload activity

Evidence notes

Evidence from NVD and CVE.org indicates an unauthenticated file upload vulnerability in J2Store versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5. The vulnerability allows direct web access to uploaded files due to missing directory protection. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources