🔒Открыть пост
и посмотреть медиа
и посмотреть медиа
J2S tore. Security Announcement - Releases 3.3.21, 4.0.21 and 4.1.6
J2Store 3.3.21, 4.0.21 and 4.1.6 are security releases that address six vulnerabilities in the com_j2store component: three authorization/IDOR issues where controller tasks accepted client-supplied identifiers without verifying ownership, one open redirect issue where user-supplied URLs were decoded and used without host validation, one unauthenticated file upload issue compounded by a missing installer manifest entry that left uploaded files web-accessible, and one stored cross-site scripting issue in the administrator order management panel exploitable via the guest checkout flow.
• Release date: 2026-08-20
• Affected versions: All J2Store versions prior to 4.1.6
• Fixed in: J2Store 3.3.21, 4.0.21 and 4.1.6
• Severity: High (CVSS 4.0 scores range from 5.1 to 8.7)
J2Store 4.x was forked and now it is J2Commerce 6.x - a free ecommerce extension for Joomla 6.
Read more
