CVE-2007-2005: Multiple PHP remote file inclusion vulnerabilities in the Taskhopper 1.1 component for Mambo and Joomla!

Security readout for executives and security teams

This old Joomla/Mambo Taskhopper 1.1 issue lets a remote attacker make vulnerable PHP files include attacker-controlled code through a configuration path parameter. If an exposed legacy site still runs this component, compromise of the web application is plausible. The source bundle does not provide CVSS, patch details, or active-exploitation evidence. Exposure is most likely on legacy internet-facing Joomla or Mambo sites with the Taskhopper 1.1 component installed. Modern environments are only relevant if they retain old migrated code, archived public sites, or forgotten virtual hosts containing the listed Taskhopper files. Prioritize remediation if any internet-facing legacy Joomla/Mambo site still contains Taskhopper 1.1. This is an old issue, but the consequence is arbitrary PHP execution, and public exploit information exists. If the component is absent, business risk is low. Mitigation focus: Identify and remove or disable Taskhopper 1.1 where it is no longer needed.; Check vendor or project guidance for any available fixed version or migration path.; Restrict public access to legacy Joomla/Mambo instances pending remediation..

Prepared

Jun 29, 2026, 06:24 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.