CVE-2026-81568
Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - `J2StoreModelOrderdownloads::getFilePath()` built the on-disk path to a purchased digital download by concatenating the configured attachment folder with the product file's stored `product_file_save_name`, using only `JPath::clean()` (which normalises separators but does not resolve or reject `..` segments) and a plain `JFile::exists()` check — never confirming the resolved path stayed inside the configured attachment folder. If a product file's `product_file_save_name` ever contained a `../` traversal segment — most plausibly via the CSRF-forgeable admin product-file save actions described in Issue 1, but equally by any future integration or bug that writes that field — any customer holding a valid download `token`/`pid` pair for that product file could have the traversal resolve to a path outside the attachment folder and download any file readable by the web server (e.g. `configuration.php`).
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.33%
- CWE
- CWE-22
- Published
- 2026-09-15
- Last modified
- 2026-09-15
Affected products
- j2commerce.com J2Store extension for Joomla
- j2commerce.com J2Store extension for Joomla
- j2commerce.com J2Store extension for Joomla
Weakness type
Related vulnerabilities
- CVE-2026-85706 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
- CVE-2026-78657 — SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field
- CVE-2026-61560 — @zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
- CVE-2026-54617 — GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler
- CVE-2026-45140 — Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
- CVE-2026-82100 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-54053 — Many Notes: Path Traversal via ZIP import allows arbitrary file write and stored XSS in other users' vaults
- CVE-2026-85661 — excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode