CVE-2026-67361

Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

MEDIUM Extension Joomla — j2commerce.com Source officielle

Description

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.

Sévérité

6.9 Moyenne · CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:X/U:X

Score retenu : NVD

Source	Sévérité d'origine	CVSS
NVD	MEDIUM	6.9 (v4.0)

Produit et versions

Produit: Extension Joomla — j2commerce.com
Corrigée dans: Non précisée
Publiée: 21/08/2026
Modifiée: 26/08/2026
CWE: CWE-352, CWE-538

Versions concernées

J2Store extension for Joomla — 1.0.0 – 3.3.20
J2Store extension for Joomla — 4.0.0 – 4.0.20
J2Store extension for Joomla — 4.1.0 – 4.1.5

Sources

NVD CNA Joomla CVE-2026-67361 vu il y a 2 h

Ces informations proviennent des sources ci-dessus ; CVE Oyer n'y ajoute aucune interprétation.

Historique

Détectée via nvd26/09/2026 09:34 UTC

RéférencesJSON

www.j2commerce.comNVD