CVEvulnerability

CVE-2026-67361

6.9 MEDIUM Published 2026-08-21 Modified 2026-08-26 Official page ↗
Status
Deferred
Published
2026-08-21
Last modified
2026-08-26
Assigner
[email protected]
CVSS 4.0 ([email protected])
6.9 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:X/U:X
Weaknesses
CWE-352, CWE-538

Description

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.

Related

Weakness · CWE (2)

  • CWE-352 Cross-Site Request Forgery weakness
  • CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory weakness

References