# CVE-2019-25740: JoomSky JS Jobs arbitrary file deletion in com_jsjobs

Source: https://junglewise.ai/threats/cve-2019-25740-joomsky-js-jobs-arbitrary-file-deletion-in-com-jsjobs  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2019-25740 · Severity: medium · CVSS 6.5 · Published 2026-06-04

JS Jobs is a popular job board extension for Joomla websites. A security flaw in version 1.2.6 allows logged-in users to delete critical system files from the web server. This could lead to a complete website outage, loss of configuration data, or the removal of important business documents.

Technologies: [JoomSky JS Jobs](https://junglewise.ai/threats/technologies/js-jobs). Vendors: [JoomSky](https://junglewise.ai/threats/vendors/joomsky).

## Quick answers

**Is CVE-2019-25740 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-25740 being exploited in the wild.

**How severe is CVE-2019-25740?** Medium severity, with a CVSS score of 6.5, published 4 June 2026.

**Which products and versions are affected?** JoomSky JS Jobs 1.2.6 and earlier.

**Is there a fix for CVE-2019-25740?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-25740 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2019-25740?** Check whether you run JoomSky JS Jobs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An arbitrary file deletion vulnerability exists in the JS Jobs (com_jsjobs) extension for Joomla, specifically within the 'job.savejob' task. The root cause is a lack of input validation in the 'storeJob' function in 'site/models/job.php', which processes custom user fields. An authenticated attacker can submit a POST request containing path traversal sequences (e.g., ../../) in the 'field_2' parameter. This input is passed to the 'unlink()' function in 'site/models/common.php' without sanitization, allowing the attacker to delete any file the web server has permissions to access, including 'configuration.php'. This vulnerability was originally identified in 2019 and affects version 1.2.6.

## Affected products

- JoomSky JS Jobs (com_jsjobs) 1.2.6 and earlier

## Timeline

- 2019-08-16: disclosed: Original exploit published on Exploit-DB
- 2026-06-04: advisory: NVD and VulnCheck published formal advisory details

## References

- [https://www.exploit-db.com/exploits/47281](https://www.exploit-db.com/exploits/47281)
- [https://www.joomsky.com/](https://www.joomsky.com/)
- [https://www.joomsky.com/5/download/1](https://www.joomsky.com/5/download/1)
- [https://www.vulncheck.com/advisories/joomla-com-jsjobs-arbitrary-file-deletion](https://www.vulncheck.com/advisories/joomla-com-jsjobs-arbitrary-file-deletion)

## Related threats

- [JoomSky Js Jobs CSRF in administrative endpoints](https://junglewise.ai/threats/cve-2018-25327-joomsky-js-jobs-csrf-in-administrative-endpoints)
- [JoomSky J2 JOBS authenticated SQL injection in sortby parameter](https://junglewise.ai/threats/cve-2020-37226-joomsky-j2-jobs-authenticated-sql-injection-in-sortby-parameter)