Executive brief
JS Jobs is a popular job board extension for Joomla websites. A security flaw in version 1.2.6 allows logged-in users to delete critical system files from the web server. This could lead to a complete website outage, loss of configuration data, or the removal of important business documents.
Technical details
An arbitrary file deletion vulnerability exists in the JS Jobs (com_jsjobs) extension for Joomla, specifically within the 'job.savejob' task. The root cause is a lack of input validation in the 'storeJob' function in 'site/models/job.php', which processes custom user fields. An authenticated attacker can submit a POST request containing path traversal sequences (e.g., ../../) in the 'field_2' parameter. This input is passed to the 'unlink()' function in 'site/models/common.php' without sanitization, allowing the attacker to delete any file the web server has permissions to access, including 'configuration.php'. This vulnerability was originally identified in 2019 and affects version 1.2.6.
Affected products
- JoomSky JS Jobs (com_jsjobs) 1.2.6 and earlier
Timeline
- 2019-08-16: disclosed: Original exploit published on Exploit-DB
- 2026-06-04: advisory: NVD and VulnCheck published formal advisory details