PatchSiren cyber security CVE debrief
CVE-2019-25740 Joomsky CVE debrief
CVE-2019-25740 is a HIGH severity vulnerability in Joomla com_jsjobs 1.2.6. The vulnerability allows authenticated attackers to delete arbitrary files by manipulating custom userfield parameters. Attackers can send POST requests to the job.savejob task with path traversal sequences in the field_2 parameter to delete arbitrary files accessible to the web server. The CVSS score for this vulnerability is 7.1.
- Vendor
- Joomsky
- Product
- JS Jobs
- CVSS
- HIGH 7.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-04
- Original CVE updated
- 2026-06-04
- Advisory published
- 2026-06-04
- Advisory updated
- 2026-06-04
Who should care
Administrators of Joomla installations using the com_jsjobs extension version 1.2.6 should prioritize patching this vulnerability to prevent potential exploitation.
Technical summary
The vulnerability exists in the com_jsjobs extension version 1.2.6 for Joomla. An attacker with authenticated access can manipulate the field_2 parameter in a POST request to the job.savejob task, using path traversal sequences to target arbitrary files accessible to the web server for deletion.
Defensive priority
HIGH
Recommended defensive actions
- Apply the latest patch or update for Joomla com_jsjobs extension to a version that fixes this vulnerability.
- Restrict access to the job.savejob task to only trusted users.
- Monitor server logs for suspicious POST requests to the job.savejob task.
Evidence notes
The CVE-2019-25740 record was obtained from the official CVE.org database. Additional information was obtained from [ref-4](https://www.exploit-db.com/exploits/47281), [ref-5](https://www.joomsky.com/), [ref-6](https://www.joomsky.com/5/download/1), and [ref-7](https://www.vulncheck.com/advisories/joomla-com-jsjobs-arbitrary-file-deletion).
Official resources
CVE-2019-25740 was published on 2019-04-10 and modified on 2019-04-10.