Security
HikaShop 6.8.1 fixes unauthorised file downloads
HikaShop 6.8.1 fixes a high-severity information disclosure flaw that could let unauthenticated visitors download files from the extension’s secure upload folder, including paid product files.
mySites.guru published research on the issue after HIKARI SOFTWARE released HikaShop 6.8.1 on 5 November 2026. The flaw affects the Starter, Essential and Business editions of HikaShop in every version below 6.8.1; 6.8.0 is also affected.
The vulnerable download route accepted a filename supplied through a text custom field, such as an engraving or address field, instead of requiring an upload field. An attacker did not need an account, but did need to know or guess the filename. The impact was unauthorised disclosure of files stored in HikaShop’s secure upload directory.
mySites.guru rates the issue 8.2 High under CVSS 4.0. No CVE identifier has been published. HIKARI SOFTWARE has not stated whether the flaw was exploited, and no researcher is credited.
Administrators should update every HikaShop installation to 6.8.1 through the Joomla updater. Sites selling downloadable products should also review web-server logs for suspicious download requests involving custom fields.
Originally reported by mySites.guru.