CVE-2026-67361

The CVSS 6.9 rating for CVE-2026-67361 masks a structural failure that standard scoring cannot capture. The J2Store file upload endpoint lacks authentication and CSRF protection—a code-level bug, fixable through a standard patch cycle. But the advisory compounds this with a separate, analytically distinct defect: the installer manifest never included .htaccess or web.config protection for the storage directories. These are not chained exploit conditions; they are independent failure modes with different remediation timelines. The critical distinction is that the packaging defect is baked into every fresh installation. Even if J2Store ships a patched version with authentication requirements, the distribution manifest itself may still omit directory protection—and critically, the Joomla extension update mechanism does not re-run installer manifests on existing installations. A site updating from 4.0.0 to 4.2.0 gets new code but retains the same unprotected directory structure. The exposure doesn't close with a patch; it persists across the install base as a distribution topology event. This creates a dangerous false signal. When the CVE closes—marked as resolved by scanners and aggregators—the packaging defect remains invisible. Attackers scanning for 'patched' J2Store installations can target the known-unprotected directories with confidence that defenders believe the issue is resolved. The historical precedent is exact: 2014-2016 WordPress plugin supply chains followed the same pattern, where code patches shipped alongside unchanged vulnerable defaults, creating an attacker ecosystem around exploiting 'patched' installations. For defenders, the remediation responsibility is split. J2Store must correct the installer manifest and push it through update channels—but site operators should not assume auto-update will deliver directory protection to existing installations. Manually verify that /media/j2store/ or equivalent storage paths have .htaccess restrictions applied, regardless of whether the extension version shows as patched. The CVSS score weights the combined attack chain as medium; the actual exposure from the persistent packaging defect is structurally higher, because it requires no authentication bypass and survives every code-level fix.

Reviewed through automated stages and approved by a human before publication.