J2Store CVE-2026-78069

Exploitation targets the J2StoreControllerApps appTask delegation path in J2Store (1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6) and requires the attacker to (a) reach that Apps-controller delegation endpoint over HTTP and (b) supply a caller-influenced table name consumed by applocalizationdata::getInstallerTool(). The primary LIMITING factor is that the shipped configuration currently returns HTTP 403 as an incidental side effect of the fof.xml wildcard-deny resolving under the unmapped singular ACL key app; direct exploitation depends on that accidental deny not being in force (reflected as AT:P/attack-requirements-present in the CVSS 4.0 vector). No authentication or user interaction is required per the vector (PR:N/UI:N).

The provided CVSS 4.0 vector (9.5, AV:N/AC:L/AT:P/PR:N/UI:N with all base and subsequent impacts High) reflects an unauthenticated network-reachable path to a file-read/SQL-execute primitive, which is genuinely severe if reachable. However, the description itself states the delegation path currently returns 403 as an accidental side effect of the fof.xml wildcard-deny - meaning in the shipped configuration the vulnerable code is not directly reachable, and exploitation depends on that incidental deny not applying (which the AT:P 'attack requirements' flag partly captures). This tension makes the AC:L/9.5 rating optimistic; a defender should treat real-world reachability as conditional and attack complexity as higher. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or automated exploitation - this reads as a high-severity code-audit finding rather than a demonstrated widespread threat. The subsequent-system High metrics (SC/SI/SA:H) also appear overstated since the impact is contained within the Joomla application/database rather than crossing a scope boundary to another security authority.

A remote, unauthenticated attacker sends a crafted request to the J2Store Apps controller's appTask delegation path and supplies a manipulated table name to getInstallerTool(), causing truncation of a #__j2store_* table and traversal to and execution of an attacker-chosen SQL file. Because the code performs no ACL check and is guarded only by an accidental fof.xml deny, any deployment where that incidental deny does not hold is directly exploitable; no public exploit code was identified at time of analysis.