CVE-2026-67361 in J2Store Extension
Summary
by MITRE • 08/21/2026
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in J2Store versions 1.0.0 through 3.3.20 and 4.0.0 through 4.1.5 represents a critical security failure involving unauthenticated file uploads combined with insufficient server-side directory protection. This flaw allows remote attackers to execute arbitrary code on the affected Joomla-based websites by uploading malicious files, such as PHP web shells, directly into publicly accessible directories. The root cause lies in two distinct but compounding configuration and implementation errors within the extension's architecture. First, the file upload endpoint fails to enforce authentication or validate Cross-Site Request Forgery tokens for POST requests originating from unauthenticated visitors. This lack of access control means that any internet user can interact with the upload functionality without needing valid credentials or session validation. Second, during fresh installations, the installer manifest incorrectly omits the creation and configuration of protective files, specifically .htaccess for Apache servers and web.config for IIS servers, within critical directories like uploads and invoices. Consequently, these directories are deployed with default permissions that allow direct HTTP access to their contents, bypassing standard server-level security restrictions designed to prevent execution of uploaded scripts.
From a technical perspective, this vulnerability aligns closely with CWE-434, which describes the unrestricted upload of files with dangerous types, and CWE-284, indicating improper access control where authentication is required but not enforced. The absence of CSRF protection further exacerbates the risk by facilitating automated exploitation via cross-site request forgery attacks, allowing an attacker to trick a victim into triggering the upload process if they are logged in as an administrator or have elevated privileges, although the unauthenticated nature of this specific flaw means even non-privileged users can exploit it. The operational impact is severe, as successful exploitation grants attackers full control over the web server's context for that application. By uploading and subsequently executing a PHP shell through direct URL access to the unprotected upload directory, an attacker can read sensitive data, modify website content, install additional malware, or pivot into other systems within the network infrastructure. This capability effectively compromises the confidentiality, integrity, and availability of the affected web service.
Mitigation strategies must address both the application-level logic flaws and the server configuration deficiencies immediately. For administrators using vulnerable versions, the most effective immediate remedy is to upgrade J2Store to a patched version where these issues have been resolved by implementing strict authentication checks on all upload endpoints and ensuring that CSRF tokens are validated for state-changing operations. Additionally, developers should verify that the installer manifest correctly includes directives to generate .htaccess or web.config files in the uploads and invoices directories upon installation. These configuration files must explicitly deny execution permissions for script languages like PHP within those specific folders while still allowing static file access if necessary. For environments where immediate upgrading is not feasible, manual intervention is required to add restrictive rules to the server configuration files. In Apache setups, adding an .htaccess file with directives such as php_flag engine off or denying all access can prevent execution of uploaded scripts. Similarly, IIS administrators should configure web.config entries to block handler mappings for executable extensions in these directories. Regular security audits and penetration testing are recommended to ensure that no other endpoints suffer from similar misconfigurations regarding authentication and directory protection standards.