CVE-2026-81568

J2Store, a Joomla e-commerce extension from j2commerce.com, builds the on-disk path for purchased digital downloads in J2StoreModelOrderdownloads::getFilePath() by concatenating the configured attachment folder with the stored product_file_save_name, applying only JPath::clean() — which normalizes separators but does not reject ../ segments — and never verifying the resolved path stays inside the attachment folder. When a customer triggers a download via task=download for a product file whose saved name contains a ../ traversal sequence, the path resolves outside the attachment folder and the requester can download any file readable by the web server, such as configuration.php containing database credentials and the Joomla secret. The traversal string is most plausibly injected through the CSRF-forgeable admin product-file save actions, so an attacker needs no server compromise to plant it, and a valid token/pid pair can be obtained by simply purchasing the product. Affected deployments are Joomla sites running J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, or 4.1.0-4.1.7 that use the digital downloads feature. There is no public PoC, no known in-the-wild exploitation, and the CVE is not in CISA's KEV catalog.

What to do: Upgrade J2Store to a build newer than the affected ranges (later than 3.3.2 on the 3.x branch, later than 4.0.22 on 4.0.x, or later than 4.1.7 on 4.1.x), which resolves and confines the download path to the attachment folder. Audit stored product_file_save_name values in the product-files table for ../ segments and review web server access logs for task=download requests containing traversal sequences. If configuration.php may have been read, rotate the database credentials and the Joomla secret and invalidate all active sessions.