The J2Store extension for Joomla suffers from an unauthenticated file upload vulnerability due to missing CSRF protection on its file upload endpoint. This endpoint accepts POST requests without a CSRF token, allowing attackers to upload files without authentication. Furthermore, the installer manifest omits the upload and invoices directories from protection configurations (.htaccess/web.config), causing these directories to be deployed without access restrictions, exposing uploaded files to direct web access. Affected versions include 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5.

An attacker can exploit this vulnerability to upload files without authentication, potentially leading to unauthorized file storage on the server. Because the uploaded files are placed in directories lacking web server access restrictions, these files become directly accessible via the web. This exposure can facilitate further attacks or data leakage. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, no required privileges or user interaction, and partial impact on integrity and system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider manually adding appropriate access control (e.g., .htaccess or web.config files) to the upload and invoices directories to prevent direct web access. Additionally, monitoring and restricting POST requests to the file upload endpoint may help mitigate exploitation risks.