External risk intelligence

Joomla J2Store Missing Authorization Path Traversal and File Execution

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-78069

The vulnerability exists in a Joomla extension, which is a component of a web application. Web applications and their extensions are commonly deployed as internet-facing services, making the vulnerable code path reachable via standard web requests from the public internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a security vulnerability identified in a Joomla extension, specifically within versions of J2Store. The issue involves missing authorization checks, potentially allowing unauthorized actions through a delegation chain. This could lead to attackers executing arbitrary code or accessing sensitive data by manipulating specific paths within the extension.

Unchecked code in a Joomla extension allows unauthorized actions.
Sensitive data and code execution risks exist if exploited.
Confirm relevance and potential exposure to affected systems.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component by sending specially crafted requests to a Joomla extension. This allows them to bypass authorization checks and interact with sensitive functions within the extension, potentially leading to unauthorized actions on the server.

Unauthenticated network access required.
Triggered by invoking appTask delegation.
Leads to file read, execute, and data manipulation.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code by manipulating app controller delegation to truncate database tables and execute SQL files. This occurs when the application uses an influenced table name without an allow-list, enabling a path-traversal capable file read and execute.

System and user data at risk.
Unauthenticated code execution.
Potential for data compromise or system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Joomla Extension, J2Store, has a critical vulnerability that allows for unauthorized execution of arbitrary SQL code. This issue is likely to be of highest concern to the application owners and platform teams responsible for managing Joomla installations and their extensions. The immediate first step should be to identify all instances of J2Store, determine their exposure and business criticality, and confirm ownership for remediation planning.

Identify accountable application owners.
Verify J2Store instance exposure.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is J2Store?

J2Store is an e-commerce extension for the Joomla content management system. It allows website administrators to transform their Joomla sites into online stores by providing tools for product management, shopping carts, and checkout processes. Because it functions as an integrated component, it interacts directly with the site's database and file system to handle store data and various application tasks.

How does CVE-2026-78069 work?

This vulnerability is a Missing Authorization flaw, categorized as CWE-862. It occurs because the extension fails to verify user permissions before performing administrative tasks. By interacting with the application's delegation chain, an unauthorized person can trick the system into executing internal functions, such as database table operations or reading and running unauthorized files, that should be protected.

When does this vulnerability trigger?

The issue is triggered when an attacker sends specially crafted requests to the J2Store 'appTask' delegation path. The vulnerability does not require authentication to initiate. It is important to note that simply having the J2Store extension installed is not the sole trigger; the attack succeeds specifically because the software fails to validate who is making the request before performing sensitive file and database operations.

Is my site at risk?

According to Halo Surface Signal, this vulnerability is likely to affect you if your Joomla instance is internet-facing. Because J2Store is a web-based component, any server running an affected version and accessible from the public internet exposes this code path to potential remote manipulation. Internal, non-public installations remain at lower risk but should still be assessed.

How should I respond to this threat?

Start by identifying all active instances of the J2Store extension across your infrastructure. Once identified, confirm which instances are accessible via the internet to prioritize your response. Coordinate with the application owners for those systems to plan for updates or necessary configuration changes. Your primary goal is to limit exposure while verifying the integrity of your current environment.

References

www.j2commerce.com/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.