Joomla’s com_jsjobs component version 1.2.6 allows an attacker who has authenticated access to delete arbitrary files on the web server. By sending a crafted POST request to the job.savejob task and including a path traversal payload in the field_2 parameter, the victim can instruct the server to delete any file that the web process can reach. This flaw can result in loss of critical data or removal of system files, potentially leading to denial of service or further exploitation.

The vulnerability affects Joomsky’s JS Jobs extension for Joomla, specifically deployment of com_jsjobs version 1.2.6. Systems running this component without an updated patch are at risk.

The CVSS score of 7.1 categorizes this as a high‑severity issue. The vulnerability is only exploitable by users who have valid Joomla credentials; however, compromised credentials are common on poorly managed sites. Because EPSS is not available and the flaw is not listed in the CISA KEV catalog, the exploitation probability is uncertain but the potential impact is substantive if accessed. The flaw is a classic CWE‑22 path traversal weakness, meaning attackers can target any filesystem path allowable to the web process.