A security fix shipped in J2Store 3.3.21, 4.0.21 and 4.1.6 for the file upload feature customers use to attach files to their cart. The issue was exploited in the wild before the fix shipped, so every store on an earlier version should update and check their files.
Am I affected?
Affected versions
- J2Store on Joomla 3 — earlier than 3.3.21
- J2Store / J2Commerce 4.0.x — earlier than 4.0.21
- J2Store / J2Commerce 4.1.x — earlier than 4.1.6
Not affected
J2Commerce 6, and any site already running 3.3.21, 4.0.21 or 4.1.6.
What was fixed
The file upload endpoint in J2Store's cart controller was missing an authentication check and a CSRF token check. Both are now in place: every upload request must carry a valid Joomla session token, and requests without one are rejected.
The update also verifies that .htaccess and web.config exist in the uploads folder on every upload, recreating them if missing, so the folder cannot be reached directly over the web.
Nothing about this changes how your store looks or works for customers.
Why the damage was contained
Joomla's built-in file validation sits in front of every upload and enforces an allowed-file-type list. PHP files, executables and scripts never made it past that check. Only non-executable types — images and documents — could be written, and they landed in a location the server will not execute.
A door with no lock, opening onto a room with nothing dangerous stored inside.
How this differs from a JCE-style incident
In that kind of incident an uploaded file stays executable and is then used to write further malicious files across a site. That chain has to start with an executable file landing on disk. Here, the file types that would start it never passed validation.
How to update
- Back up your site.
- Update to 3.3.21 (Joomla 3), 4.0.21 (v4.0.x) or 4.1.6 (v4.1.x).
- Update your add-ons.
- If you use template overrides, the extension tells you which files need updating and with what content.
The update scans your site for you
The installer runs a scan during the update and shows one of four results on the Joomla update screen.
Clean
The uploads folder is empty and the database table has no records. Nothing further to do.
Exploited
Files were found on disk and no "File" type product option has ever been configured, so every upload may be foreign. The installer does not delete them nor clears the uploads database table. Why did we choose this solution? Because some add-ons may also add files to the uploads folder (known add-ons like 'Upload Files During Checkout' or unkown ones - customized to your store).
Suspicious
You have a "File" type product option configured, so some uploads may be genuine customer files. Unexpected files were still found. The installer lists them for review and does not delete anything — check the list and remove only what you do not recognise.
Unknown
The database could not be queried. Review media/j2store/uploads/ yourself.
Files in the older media/com_j2store/uploads/ location are always listed for manual review and are never removed automatically. Clear those through FTP or your host's file manager (cPanel, Plesk or similar).
Full advisory
Complete details, including the full list of issues patched in these releases, are in the security advisory under CVE-2026-67361.
Check the security adisory for the full list of vulnerabilities patched in the security releases.