K2
Affected versions: < 2.26
Full advisory: cve.threatint.eu
CVE-2026-48940CriticalPublished 1 January 2026
K2 (com_k2) below 2.26 - CVE-2026-48940 to 48946 - Multiple RCE (unrestricted upload), Path Traversal, Stored XSS, Unauthenticated Folder Delete and Mass Assignment
K2 by JoomlaWorks before 2.26 is affected by a cluster of vulnerabilities disclosed July 2026 and all fixed in 2.26. CVE-2026-48945 and CVE-2026-48946: a privileged K2 author can achieve RCE by uploading a PHP file (via the article attachment path, or a zip/tar extracted under /media/k2/galleries where non-image files keep their extension) and executing it. CVE-2026-48944: path traversal in the attachment copy handler lets an author copy configuration.php or other server files into /media/k2/attachments and download them. CVE-2026-48941: an unauthenticated request to the item.checkin task with a crafted sigProFolder parameter deletes arbitrary folders under /media/k2/galleries. CVE-2026-48940 and CVE-2026-48942: stored XSS via the embedVideo field and the K2 user image field. CVE-2026-48943: mass assignment via plg_user_k2 lets a registered user write arbitrary values to their own #__k2_users row. Update K2 to 2.26 or later.
Affected versions: < 2.26
Official record: cve.org · NVD
Related vulnerabilities
Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.
Affected extensions and versions
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 25 August 2026.