---
id: CVE-2026-90901
title: >-
  Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in
  Media Image Deletion in Easy Store extension 1.0.0-3.0.0 -  The media deletion
  endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage)
  …
summary: >-
  Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in
  Media Image Deletion in Easy Store extension 1.0.0-3.0.0 -  The media deletion
  endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage)
  …
severity: high
cvss: 8.6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-89
  - CWE-74
vendor: joomshaper.com
product: Easy Store extension for Joomla
affected:
  - easy_store_extension_for_joomla 1.0.0-3.0.0
published: '2026-09-23'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T18:17:32.110'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90901'
references:
  - url: 'https://www.joomshaper.com/easystore'
    label: security@joomla.org
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-23T19:34:17.625210Z'
cvssSource: cna
epss: 0.00398
epssPercentile: 0.31261
ingestedAt: '2026-09-23T19:31:04.471Z'
---

## Overview

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 -  The media deletion endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage) parsed the ids parameter as a comma-separated string and imploded it directly into raw SQL IN (...) clauses in Media.php and MediaModel.php without integer casting or parameterization. An authenticated administrator or attacker with access to an admin session could inject arbitrary SQL statements.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.