← CVE Intelligence

CVE-2026-67361

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 PUBLISHED

Description (CNA)

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.

Affected (CNA)

Vendor / productVersions
j2commerce.com / J2Store extension for Joomlaaffected 1.0.0-3.3.20; affected 4.0.0-4.0.20; affected 4.1.0-4.1.5

CWE

CWE-352, CWE-538

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.