Medium severity · published Jun 4, 2026
CVE-2019-25740
Joomla com_jsjobs 1.2.6 Arbitrary File Deletion
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Joomla com_jsjobs 1.2.6 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating custom userfield parameters. Attackers can send POST requests to the job.savejob task with path traversal sequences in the field_2 parameter to delete arbitrary files accessible to the web server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JJ
JS Jobs · Joomsky
1.2.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-25740
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-25740
www.exploit-db.com
https://www.exploit-db.com/exploits/47281
www.joomsky.com
https://www.joomsky.com/
www.joomsky.com
https://www.joomsky.com/5/download/1
www.vulncheck.com
https://www.vulncheck.com/advisories/joomla-com-jsjobs-arbitrary-file-deletion
More from JS Jobs
9.8
CVE-2019-17527
dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the…
9.8
CVE-2018-5994
SQL Injection exists in the JS Jobs 1.1.9 component for Joomla! via the zipcode parameter in a newest-jobs request, or the ta parameter in a view_resume request
5.4
CVE-2018-9183
The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS
5.3
CVE-2018-25327
Joomla! Component Js Jobs 1.2.0 Cross-Site Request Forgery
4.7
CVE-2025-22208
Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla