This vulnerability arises from the J2Store 'download' feature that constructs file paths by concatenating a configured attachment directory with a product file's stored name. The concatenation uses only path normalization but does not reject or resolve '..' segments, and the resulting path is only checked with a basic file existence test. Because the stored name can contain directory traversal characters, a client with a valid download token can request a file whose resolved path lies outside the intended attachment folder, allowing read access to any file readable by the web server, such as Joomla's configuration file. The weakness is a file path traversal flaw (CWE-22).

Joomla websites that install the 1.0.0-3.3.2, 4.0.0-4.0.22, or 4.1.0-4.1.7 releases of the J2Store extension from j2commerce.com are vulnerable. The issue exists across all Joomla installations that incorporate the affected versions of J2Store and have the download functionality enabled.

The CVSS score of 8.7 indicates a high severity vulnerability, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid download token and product ID; the likely attack vector is a remote web request to the J2Store download endpoint.