CVE-2026-67361: J2Store Authentication Bypass Vulnerability

CVE-2026-67361 Overview

CVE-2026-67361 affects the J2Store extension for Joomla, developed by J2 Commerce. The vulnerability combines an unauthenticated file upload endpoint with missing directory protection. The file upload endpoint accepts POST requests from unauthenticated visitors without requiring a Cross-Site Request Forgery (CSRF) token. The installer manifest omits the upload and invoices directories, so fresh installations deploy these paths without .htaccess or web.config protection. Uploaded files therefore remain directly web-accessible. The flaw is tracked under [CWE-352] (Cross-Site Request Forgery).

Critical Impact
Unauthenticated attackers can upload arbitrary files to publicly accessible directories on Joomla sites running vulnerable J2Store versions.

Affected Products

J2Store 1.0.0 through 3.3.20
J2Store 4.0.0 through 4.0.20
J2Store 4.1.0 through 4.1.5

Discovery Timeline

2026-08-21 - CVE-2026-67361 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-67361

Vulnerability Analysis

The vulnerability results from two compounding weaknesses in the J2Store Joomla extension. First, a file upload endpoint accepts POST requests without authentication and without validating a CSRF token. Second, the extension's installer manifest omits the upload and invoices directories from the packaged asset list. Because those directories are absent from the manifest, fresh installs create them at runtime without accompanying .htaccess or web.config files. The result is a writable directory reachable directly over HTTP.

An attacker can submit crafted POST requests to the upload endpoint and then retrieve the stored content by its predictable web path. This creates conditions for content staging, phishing payload hosting, and secondary exploitation depending on server-side handler configuration.

Root Cause

The root cause is the combination of a missing authentication and CSRF check on the upload handler with an incomplete installer manifest. Directory-level protection files that normally block direct access to writable paths are never deployed, so no defense-in-depth layer catches the initial input validation gap.

Attack Vector

Exploitation requires only network access to the Joomla site. No authentication, user interaction, or elevated privileges are required. An attacker sends a POST request to the exposed J2Store upload endpoint and then requests the resulting file through the public upload or invoices path.

// No verified public proof-of-concept code is available.
// See the J2 Commerce advisory for technical details:
// https://www.j2commerce.com/

Detection Methods for CVE-2026-67361

Indicators of Compromise

Unexpected files in the J2Store upload or invoices directories that do not match legitimate order or invoice records.
Web server access logs showing POST requests to J2Store upload endpoints from unauthenticated sessions or unknown source addresses.
Requests to files with executable or script extensions served from the upload or invoices paths.

Detection Strategies

Inventory J2Store installations and compare the installed version against the vulnerable ranges 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5.
Audit the upload and invoices directories for the presence of .htaccess or web.config files that restrict direct access.
Review web application firewall (WAF) logs for POST requests to J2Store upload paths lacking a valid Joomla session or CSRF token.

Monitoring Recommendations

Enable file integrity monitoring on the J2Store upload and invoices directories to alert on new file creation.
Forward Joomla and web server logs to a centralized analytics platform to correlate upload activity with subsequent file retrieval.
Alert on any HTTP requests that fetch newly created files from J2Store writable directories within a short window of the upload.

How to Mitigate CVE-2026-67361

Immediate Actions Required

Upgrade J2Store to a fixed release published by J2 Commerce that addresses both the upload authentication gap and the installer manifest.
Manually deploy .htaccess and web.config files to the upload and invoices directories to block direct web access to uploaded content.
Audit both directories for unauthorized files and remove any content not tied to legitimate orders or invoices.

Patch Information

Refer to the J2 Commerce vendor site for the current patched release of J2Store and upgrade instructions. Apply the update across all Joomla environments running J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, or 4.1.0-4.1.5.

Workarounds

Restrict access to the J2Store upload endpoint at the WAF or reverse proxy layer until the patch is applied.
Add explicit Deny from all rules in .htaccess for Apache or <requestFiltering> rules in web.config for IIS on the upload and invoices paths.
Disable script execution in writable directories by removing handler mappings for PHP or other server-side languages.

bash

# Example Apache .htaccess placed in the upload and invoices directories
# Blocks direct HTTP access and script execution
<FilesMatch ".*">
    Require all denied
</FilesMatch>

<FilesMatch "\.(php|phtml|phar|pl|py|jsp|asp|sh|cgi)$">
    Require all denied
</FilesMatch>

Options -ExecCGI
AddHandler cgi-script .php .phtml .phar