CVE-2026-81568

Summary

Joomla Extension - j2commerce.com - Arbitrary file read via task=download in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - J2StoreModelOrderdownloads::getFilePath() built the on-disk path to a purchased digital download by concatenating the configured attachment folder with the product file's stored product_file_save_name, using only JPath::clean() (which normalises separators but does not resolve or reject .. segments) and a plain JFile::exists() check — never confirming the resolved path stayed inside the configured attachment folder. If a product file's product_file_save_name ever contained a ../ traversal segment — most plausibly via the CSRF-forgeable admin product-file save actions described in Issue 1, but equally by any future integration or bug that writes that field — any customer holding a valid download token/pid pair for that product file could have the traversal resolve to a path outside the attachment folder and download any file readable by the web server (e.g. configuration.php).

Affected Software

Weaknesses

• CWE-22: CWE-22 Improper Limitation of a Pathname to a Restricted Directory

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://www.j2commerce.com/

• ←Previous
• Next→