What is GHSA-2vmq-jqv2-9gfv?

GHSA-2vmq-jqv2-9gfv is a security advisory published by GitHub Security Advisories with Medium severity. Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection...

Which CVE IDs does GHSA-2vmq-jqv2-9gfv cover?

GHSA-2vmq-jqv2-9gfv covers the following CVE IDs: CVE-2026-67361. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-2vmq-jqv2-9gfvMedium

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection...

Vendor

GitHub Security Advisories

Published

August 21, 2026

Last Modified

August 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-67361 →

📋 Description

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-67361
https://www.j2commerce.com
https://github.com/advisories/GHSA-2vmq-jqv2-9gfv