Skip to main content

J2Store CVE-2026-67361

| EUVDEUVD-2026-64064 MEDIUM
Cross-Site Request Forgery (CSRF) (CWE-352)
2026-08-21 Joomla GHSA-2vmq-jqv2-9gfv
File Upload CSRF J2Store Extension For Joomla
6.9
CVSS 4.0 · Vendor: Joomla
Share

Severity by source

Vendor (Joomla) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:X/U:X
vuln.today AI
5.8 MEDIUM

Network vector, no auth or complexity required; scope change because uploaded files are web-accessible to external clients beyond the application boundary; low integrity without independently confirmed RCE.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 21, 2026 - 19:52 vuln.today

DescriptionCVE.org

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.

AnalysisAI

Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 permits any remote visitor to POST arbitrary files to the upload endpoint without authentication or CSRF validation. A compounding installer manifest defect omits .htaccess and web.config protection for the upload and invoices directories on fresh installs, making uploaded files directly web-accessible over HTTP. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send unauthenticated POST to upload endpoint
Delivery
Bypass missing CSRF token check
Exploit
Write arbitrary file to unprotected upload or invoices directory
Execution
Request uploaded file via direct URL
Impact
Execute payload if PHP execution is permitted
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No authentication, CSRF token, or special session state is required - exploitation targets the unauthenticated file upload endpoint directly over HTTP with a standard multipart POST. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.9 with base metrics AV:N/AC:L/AT:N/PR:N/UI:N reflects zero-friction, fully unauthenticated remote exploitation requiring no attack complexity or preconditions - an HTTP client is sufficient. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker sends a crafted HTTP POST request to the J2Store file upload endpoint on a freshly installed, network-reachable Joomla site, submitting a PHP webshell without providing any session cookie or CSRF token - the request is accepted and the file is written to the upload or invoices directory. Because those directories lack .htaccess protection, the attacker retrieves the shell via a direct URL and, if the server does not independently block PHP execution in the upload path, achieves remote code execution under the web server process account. …
Remediation Upgrade J2Store beyond the affected version ranges - above 3.3.20 for the 3.x branch, above 4.0.20 for the 4.0.x branch, or above 4.1.5 for the 4.1.x branch - per the vendor advisory at https://www.j2commerce.com/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in J2Store Extension For Joomla

View all
CVE-2026-67359 HIGH
8.7 Aug 21

Order content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20,
CVE-2026-74252 HIGH
8.6 Aug 21

Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious sc
CVE-2026-67360 MEDIUM
6.3 Aug 21

Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, an
CVE-2026-67358 MEDIUM
5.3 Aug 21

Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment d
CVE-2026-67362 MEDIUM
5.1 Aug 21

Open redirect in the J2Store Joomla e-commerce extension (versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) enables

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique File Upload

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2017-12617 HIGH POC
8.1
CVE-2020-1938 CRITICAL POC
9.8
CVE-2024-50623 CRITICAL POC
9.8
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2018-9206 CRITICAL POC
9.8
CVE-2024-5084 CRITICAL POC
9.8

Share

CVE-2026-67361 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy