K2 (com_k2) 1.0 to 2.26 - Unauthenticated Gallery Folder Deletion, Authenticated Arbitrary File Upload (RCE), Path Traversal and Stored XSS

K2 versions 1.0 to 2.26 are affected by six issues (CVE-2026-48941, CVE-2026-48942, CVE-2026-48943, CVE-2026-48944, CVE-2026-48945, CVE-2026-48946). The most serious needs no login at all: the frontend item.checkin task accepted a sigProFolder parameter and deleted the matching folder under /media/k2/galleries/ with no authentication, no CSRF token and no ownership check, so any anonymous visitor could wipe gallery contents with a single GET request. The other five require author or administrator access that a site administrator has explicitly granted, and are remote code execution via gallery ZIP extraction (non-image files, including .php, were left in place under the publicly served gallery folder), path traversal in the attachment 'existing' field, user property mass-assignment, and stored XSS. Fixed in K2 2.27, released 7 June 2026. K2 2.28 is the current release and also contains the fix. K2 2.26 does NOT contain the fix and is affected. Note that the CVE records contradict themselves on this point: all six are titled 'K2 extension for Joomla < 2.26' while their structured affected range reads 1.0-2.26. The vendor changelog settles it, because 2.26 (31 May 2026) is a YOOtheme Pro and PHP 8 compatibility release while 2.27 is the security release that names every one of these findings.

Affected versions: ≥ 1.0 and ≤ 2.26

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions