CVE-2019-25760: Joomla! Component Easy Shop 1.2.3 Local File Inclusion

Published Jun 19, 2026

Updated

Joomla! Component Easy Shop 1.2.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by supplying base64-encoded file paths. Attackers can send GET requests to index.php with the option parameter set to comeasyshop, task set to ajax.loadImage, and a base64-encoded file path in the file parameter to retrieve sensitive files like configuration.php and system files.

Affected Software

2 affected components

Joomla Easy Shop=1.2.3

Joomtech Easy Shop Joomla\!=1.2.3

Event History

Jun 19, 2026

CVE Published

via MITRE·05:42 PM

Data Sourced

via MITRE·05:42 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-25760?

The severity of CVE-2019-25760 is classified as medium with a score of 6.2.

How do I fix CVE-2019-25760?

To fix CVE-2019-25760, update the Joomla Component Easy Shop to the latest version that addresses this vulnerability.

What type of vulnerability is CVE-2019-25760?

CVE-2019-25760 is a local file inclusion vulnerability affecting Joomla! Component Easy Shop.

Who is affected by CVE-2019-25760?

Unauthenticated attackers can exploit CVE-2019-25760 to read arbitrary files on affected Joomla installations.

What can attackers achieve with CVE-2019-25760?

Attackers can leverage CVE-2019-25760 to read sensitive files from the server by supplying base64-encoded file paths.