The J2Store extension for Joomla contains an improper limitation of a pathname to a restricted directory (CWE-22) in the method J2StoreModelOrderdownloads::getFilePath(). This method constructs the file path for purchased digital downloads by concatenating a configured attachment folder with the stored product file name. It only uses JPath::clean() to normalize separators and JFile::exists() to check file existence, but does not verify that the resolved path remains within the intended directory. If the product_file_save_name contains '../' segments, an attacker with a valid download token can exploit this to perform directory traversal and read arbitrary files accessible by the web server, such as configuration files. This is most likely exploitable if an attacker can manipulate the product_file_save_name via CSRF-forgeable admin actions or other bugs.

An attacker with a valid download token can read arbitrary files on the web server outside the intended download directory. This can lead to disclosure of sensitive information such as configuration files, potentially aiding further attacks or information leakage. The vulnerability does not require user interaction or privileges beyond possessing a valid download token and product ID.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the download functionality to trusted users and monitor for suspicious activity. Review and harden administrative interfaces to prevent unauthorized modification of product_file_save_name values. Validate and sanitize file path inputs to ensure they do not contain directory traversal sequences.