CVE-2019-25760: Joomla Easy Shop Path Traversal Flaw

CVE-2019-25760 Overview

CVE-2019-25760 is a local file inclusion (LFI) vulnerability in the Joomla! Easy Shop component version 1.2.3, developed by JoomTech. The flaw resides in the ajax.loadImage task handler within com_easyshop, which accepts a base64-encoded file path through the file parameter without validation. Unauthenticated attackers can decode and resolve arbitrary file paths to retrieve sensitive files, including the Joomla configuration.php file containing database credentials. The vulnerability is classified under [CWE-98] (Improper Control of Filename for Include/Require Statement). It carries a CVSS 4.0 score of 6.9 and an EPSS probability of 0.426%.

Critical Impact
Unauthenticated attackers can read arbitrary files on the host, including Joomla configuration files containing database credentials and system files such as /etc/passwd.

Affected Products

Joomla! Easy Shop component version 1.2.3 (JoomTech)
Joomla! installations with the Easy Shop extension enabled
Web servers hosting the vulnerable component accessible via HTTP

Discovery Timeline

2026-06-19 - CVE-2019-25760 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2019-25760

Vulnerability Analysis

The Easy Shop component exposes an AJAX endpoint that serves image files referenced by user-supplied paths. The handler accepts the file parameter as base64-encoded data, decodes it server-side, and reads the resulting file from disk. The decoded path is not validated against an allowed directory or filtered for traversal sequences. Attackers can therefore encode paths such as ../../configuration.php or /etc/passwd and receive the file contents in the HTTP response.

This behavior maps to [CWE-98], where untrusted input controls the filename argument of a file inclusion or read operation. The encoding step does not act as a security control because base64 is reversible and adds no validation. The endpoint is reachable without authentication, lowering the barrier for exploitation.

Root Cause

The root cause is the absence of path canonicalization and allow-list validation in the ajax.loadImage task. The component trusts the decoded file parameter directly as a filesystem path. There is no check that the resolved path remains within the component's intended image directory.

Attack Vector

Attackers issue a GET request to index.php with option=com_easyshop, task=ajax.loadImage, and file set to the base64 encoding of the target path. The server returns the file contents in the response body. An attacker who recovers database credentials from configuration.php can pivot to direct database access or administrative takeover.

The vulnerability mechanism is documented in the Exploit-DB entry #46219 and the VulnCheck Joomla Advisory. No verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2019-25760

Indicators of Compromise

HTTP GET requests to index.php containing option=com_easyshop and task=ajax.loadImage parameters
Requests with a file parameter containing base64-encoded strings that decode to paths with ../ traversal sequences or absolute paths such as /etc/passwd
Web server access logs showing repeated ajax.loadImage requests from a single source IP within a short window
Responses to ajax.loadImage requests that return non-image content types or unusually large payloads

Detection Strategies

Inspect web server and WAF logs for the parameter combination option=com_easyshop&task=ajax.loadImage&file= and decode the file value to identify path traversal attempts
Apply signatures matching base64-encoded variants of configuration.php, /etc/passwd, and ../ sequences in query strings
Correlate ajax.loadImage requests with subsequent database authentication anomalies that may indicate credential reuse

Monitoring Recommendations

Enable verbose access logging on Joomla front-controllers and forward logs to a centralized analytics platform
Alert on outbound connections from the web server to unexpected destinations following suspicious com_easyshop traffic
Track file read activity on configuration.php and other sensitive files outside expected administrative workflows

How to Mitigate CVE-2019-25760

Immediate Actions Required

Disable or uninstall the Easy Shop component (com_easyshop) version 1.2.3 from affected Joomla! installations until a fixed release is confirmed
Rotate Joomla database credentials and any secrets stored in configuration.php if exploitation is suspected
Block requests containing task=ajax.loadImage at the WAF or reverse proxy layer for installations that cannot remove the component

Patch Information

No vendor patch is referenced in the available advisory data. Consult the Joomla Extension: Easy Shop listing and the JoomTech Website for any updated releases before reinstalling the component.

Workarounds

Remove the Easy Shop extension entirely if a patched version is not available from JoomTech
Deploy WAF rules that decode base64 query parameters and reject values containing ../, absolute paths, or non-image file extensions
Restrict the web server process with filesystem permissions that prevent reads outside the Joomla document root where feasible

bash

# Example ModSecurity rule to block the vulnerable endpoint
SecRule ARGS:option "@streq com_easyshop" \
  "chain,id:1925760,phase:2,deny,status:403,msg:'Block CVE-2019-25760 Easy Shop LFI'"
  SecRule ARGS:task "@streq ajax.loadImage"