CVE-2026-81568: J2Store Path Traversal Vulnerability

CVE-2026-81568 Overview

CVE-2026-81568 is a path traversal vulnerability [CWE-22] in the J2Store extension for Joomla, published by j2commerce.com. The flaw resides in the J2StoreModelOrderdownloads::getFilePath() function, which constructs on-disk paths to purchased digital downloads without validating that the resolved path remains inside the configured attachment folder. Affected versions include J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7. An authenticated customer holding a valid token/pid pair for a product file with a poisoned product_file_save_name can read arbitrary files accessible to the web server, including sensitive files such as configuration.php.

Critical Impact
Arbitrary file read via the task=download endpoint enables disclosure of Joomla configuration files, database credentials, and any other file readable by the web server process.

Affected Products

J2Store for Joomla versions 1.0.0 through 3.3.2
J2Store for Joomla versions 4.0.0 through 4.0.22
J2Store for Joomla versions 4.1.0 through 4.1.7

Discovery Timeline

2026-09-15 - CVE-2026-81568 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-81568

Vulnerability Analysis

The vulnerability originates in the J2Store order downloads model, specifically the J2StoreModelOrderdownloads::getFilePath() method. This function assembles the absolute path to a customer's purchased digital file by concatenating the configured attachment folder with the product_file_save_name value stored in the database. The concatenated path is normalized with JPath::clean() and existence is confirmed with JFile::exists(). Neither of these calls resolves or rejects .. traversal segments. As a result, if a product record's product_file_save_name contains directory traversal sequences, the download handler will resolve the path outside the intended attachment directory. The task=download endpoint then streams the file back to the requester, enabling arbitrary file disclosure.

Root Cause

The root cause is missing canonical path validation. JPath::clean() normalizes separators but does not enforce a base-directory boundary. Because the download logic never compares the resolved absolute path against the configured attachment root, any traversal sequence written into product_file_save_name is honored. This is a classic instance of improper limitation of a pathname to a restricted directory [CWE-22].

Attack Vector

Exploitation requires that the product_file_save_name field for a product contain a traversal segment such as ../. The advisory notes this field could be populated via cross-site request forgery against the admin product-file save actions, or through any future integration or bug that writes the field. Once poisoned, any customer who possesses a valid download token and pid pair for that product can invoke the task=download endpoint. The traversal resolves outside the attachment folder, and the file, for example configuration.php, is returned in the HTTP response.

No verified public exploit code is available. Refer to the J2 Commerce Homepage for vendor communications and advisory details.

Detection Methods for CVE-2026-81568

Indicators of Compromise

HTTP requests to the J2Store download endpoint containing task=download with unusually long or encoded token/pid parameters.
Web server access logs showing successful 200 responses for download requests immediately followed by outbound transfer of configuration.php sized payloads.
Database records in the J2Store product files table where product_file_save_name values contain ../, URL-encoded traversal sequences, or absolute paths.

Detection Strategies

Audit the J2Store product files database table for any product_file_save_name values containing .., /, or backslash characters outside the expected filename format.
Correlate Joomla admin CSRF-eligible requests to product-file save actions with subsequent customer download activity for the same product identifier.
Deploy web application firewall rules that inspect the task=download request parameters and downstream file paths for traversal patterns.

Monitoring Recommendations

Monitor web server file access telemetry for reads of configuration.php, .env, or other sensitive Joomla files by the PHP process outside expected administrative workflows.
Alert on repeated download requests from a single authenticated session that reference the same pid but produce different file sizes or content types.
Track integrity of the J2Store attachment folder and log any file reads originating from the download controller that resolve outside that folder.

How to Mitigate CVE-2026-81568

Immediate Actions Required

Upgrade J2Store to a fixed release above 4.1.7 as published by j2commerce.com.
Audit the J2Store product files database table and remove or sanitize any product_file_save_name values containing traversal sequences.
Rotate Joomla configuration.php secrets, database credentials, and any API keys that may have been exposed if exploitation is suspected.

Patch Information

Refer to the vendor page at the J2 Commerce Homepage for the current fixed version of J2Store. Administrators running affected versions in the 1.0.0-3.3.2, 4.0.0-4.0.22, or 4.1.0-4.1.7 ranges should apply the vendor's remediated release and verify that J2StoreModelOrderdownloads::getFilePath() enforces containment within the attachment folder.

Workarounds

Restrict access to the Joomla administrator interface using IP allow lists to reduce exposure of the CSRF-forgeable product-file save action.
Configure the web server user with least-privilege file system permissions so that files outside the J2Store attachment folder cannot be read by the PHP process.
Deploy a web application firewall rule that blocks requests to index.php?option=com_j2store&task=download when pid or referenced file paths contain .. or encoded traversal patterns.

bash

# Configuration example: Apache mod_security rule to block traversal in J2Store download requests
SecRule REQUEST_URI "@contains task=download" \
    "chain,phase:2,deny,status:403,id:1026815680,msg:'J2Store CVE-2026-81568 traversal attempt'"
    SecRule ARGS|REQUEST_URI "@rx (\.\./|%2e%2e%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"