Security Announcement - Releases 3.3.21, 4.0.21 and 4.1.6

Release date: 2026-08-20
Affected versions: All J2Store versions prior to 4.1.6
Fixed in: J2Store 3.3.21, 4.0.21 and 4.1.6
Severity: High (CVSS 4.0 scores range from 5.1 to 8.7)

Overview

J2Store 3.3.21, 4.0.21 and 4.1.6 are security releases that address six vulnerabilities in the com_j2store component: three authorization/IDOR issues where controller tasks accepted client-supplied identifiers without verifying ownership, one open redirect issue where user-supplied URLs were decoded and used without host validation, one unauthenticated file upload issue compounded by a missing installer manifest entry that left uploaded files web-accessible, and one stored cross-site scripting issue in the administrator order management panel exploitable via the guest checkout flow.

Users running any version of J2Store prior to 4.1.6 are advised to update immediately.

Vulnerabilities Fixed

1. Download quota manipulation via updateHitCount

CVE: CVE-2026-67358
Task: POST com_j2store / view=myprofile / task=updateHitCount
CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N / Base Score: 5.3 / Severity: Medium

A guest or authenticated user with a valid order token could increment the download limit_count of a download record belonging to a different order. The token check only confirmed the caller owned their own order; it did not verify that the submitted download record ID was associated with that order. Additionally, the endpoint lacked a CSRF token check.

Impact: An attacker could exhaust another customer's download quota or inflate download counters for arbitrary files.

2. Order content disclosure via expressconfirm

CVE: CVE-2026-67359
Task: GET com_j2store / view=checkout / task=expressconfirm
CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N / Base Score: 8.7 / Severity: High

An unauthenticated visitor could pass any order_id as a URL query parameter to render the full express-checkout confirmation page for that order, including line items, quantities, prices, and totals. When no active checkout session existed, the request-supplied value was used directly with no authentication check.

Impact: Unauthenticated read access to any customer's order line items and financial totals.

3. Cross-customer order replication via reOrder

CVE: CVE-2026-67360
Task: GET com_j2store / view=myprofile / task=reOrder
CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N / Base Score: 8.7 / Severity: High

An authenticated user who obtained another customer's order_id could initiate a reorder for that order. The method validated the Joomla CSRF token and confirmed the caller was logged in, but did not check that the loaded order belonged to the caller. Executing the task copied the victim's items into the attacker's cart and stored the victim's billing and shipping address IDs into the attacker's session.

Impact: Authenticated users could read another customer's product selections, quantities, variant options, and address data.

4. Unauthenticated file upload with missing directory protection

CVE: CVE-2026-67361
Task: POST com_j2store / view=carts / task=upload
CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:A / Base Score: 8.7 / Severity: High (Threat metric E:A — exploited in the wild)
Files: components/com_j2store/controllers/carts.php, j2store.xml, 29 product option templates

The file upload endpoint — used by products with a “file” type option — accepted POST requests from unauthenticated visitors with no CSRF token. Any HTTP client that knew the URL could upload files directly without loading a product page or holding a session.

Compounding the exposure, the installer manifest (j2store.xml) omitted the media/j2store/uploads/ and media/j2store/invoices/ directories from the <media> section. On fresh installations both directories were created at runtime without their .htaccess (deny from all) and web.config (deny users="*") protection files, leaving uploaded files directly web-accessible by URL.

Impact: An unauthenticated attacker could upload arbitrary files of any type permitted by Joomla's Media Manager (images, PDFs, CSVs, documents) and immediately retrieve them via a public URL. This was exploited in the wild: PHP files were blocked by MediaHelper::canUpload(), so remote code execution was not achieved.

Read more about this vulnerability and what it means to you.

5. Open redirect in cart controller

CVE: CVE-2026-67362
Tasks: setcurrency, addItem, applyCoupon, applyVoucher
CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N / Base Score: 5.1 / Severity: Medium
File: components/com_j2store/controllers/carts.php

Four cart task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host. Base64 encoding is not a security control and is trivially reversible. Wrapping the result in JRoute::_() (as two of the handlers did) provided no protection — JRoute::_() returns absolute external URLs unchanged.

Impact: An attacker could craft a legitimate-looking J2Store cart URL (add to cart, apply coupon, change currency) that silently redirected the victim to an arbitrary external site after the action completed, enabling phishing and credential harvesting using the shop's trusted domain. No authentication required.

6. Stored XSS in administrator order panel via guest checkout cookie bypass

CVE: CVE-2026-74252
CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L / Base Score: 8.3 / Severity: High
Files: components/com_j2store/controllers/checkouts.php, five administrator order template files

An unauthenticated attacker could permanently store an XSS payload in the billing_first_name (and other address) fields via the guest checkout endpoint, which would then execute automatically in every administrator's browser when they viewed the orders listing — no click on any individual order required.

Root cause — two compounding weaknesses

1. Incorrect handling of customer‑submitted data. Under certain conditions, the checkout process could accidentally accept information from the browser that did not come from the customer’s actual form submission. This meant that unexpected or unwanted data could be stored instead of the real input.
2. Unsafe display of stored data in the administrator area. Some administrator pages showed stored address information without converting special characters into safe text. If any unexpected content had made its way into the stored data, it could run inside the administrator’s browser when viewing an order.

Impact: JavaScript executing in the administrator backend can hijack the admin session, create rogue super-administrator accounts, install malicious plugins to achieve remote code execution, or exfiltrate the entire database. The attack requires no authentication and no victim interaction beyond the administrator's routine visit to the orders page.

Who Is Affected

Any J2Store installation prior to 4.1.6 where:

• Downloadable products are sold (issue 1)
• Easy Checkout is used (issue 2)
• The Reorder feature is available to customers (issue 3)
• The shop is publicly accessible (issues 4 and 5)
• The site was upgraded from J2Store v3 or early v4 and has a legacy media/com_j2store/uploads/ directory (issue 4 — legacy path, also unprotected)
• Guest checkout is enabled (issue 6) — the default configuration on most shops

Actions Required

Backup your site.
Update to J2Store 3.3.21 if you are still under Joomla 3, 4.0.21 if you run 4.0.+, update to J2Store 4.1.6 if you run 4.1.+. No configuration changes or workarounds are required beyond installing the update.
The update will warn you if you have been impacted and will attempt a cleanup.

Make sure you are up-to-date with plugins as well. Mainly update Detail Cart, Advanced Checkout and Easy Checkout.

If you are unable to update immediately:

• Issue 1: Disable downloadable products until the update can be applied.
• Issue 2: Update Easy Checkout, Advanced Checkout, Advanced Cart if used.
• Issue 3: There is no frontend toggle for reOrder; restrict frontend access to the myprofile view (it is usually restricted, but make sure) or require login for all store pages.
• Issue 4: If you were affected (files appeared in media/j2store/uploads/ unexpectedly), review the #__j2store_uploads database table to identify uploaded files, remove all foreign files from the uploads/ and invoices/ directories, and check your web server access logs for external retrieval of those files. Manually place a .htaccess file containing deny from all in both directories as an immediate stopgap until the update can be applied. If your site was previously running J2Store v3 or early v4, also check and protect the legacy media/com_j2store/uploads/ directory — the update does not cover that path and manual action is required.
• Issue 5: There is no setting to disable the affected cart actions. If your hosting provider offers a web application firewall (WAF) or similar traffic filtering, ask them to block requests to your J2Store cart that include a redirect or return field pointing to an external website. Otherwise, updating to the patched version is the only reliable remedy.
• Issue 6: Disable guest checkout in J2Store configuration until the update can be applied. If you suspect your site may have already been targeted, inspect the billing_first_name and billing_last_name columns in #__j2store_orderinfos for HTML or script content.

Credits

Issues 1, 2, 3 and 5 were identified by Murrez (This email address is being protected from spambots. You need JavaScript enabled to view it.). Issue 4 (unauthenticated file upload) was identified by Terry Harker (Co-Founder of byteKultur GmbH) and was exploited in the wild prior to the release of this advisory. Issue 6 (stored XSS) was identified by Toan Le (https://github.com/toanln-cov).

Thank you to the Joomla Security Strike Team for their help in the matter.