K2 (com_k2) below 2.26 - CVE-2026-48940 to 48946 - Multiple RCE (unrestricted upload), Path Traversal, Stored XSS, Unauthenticated Folder Delete and Mass Assignment
K2 by JoomlaWorks before 2.26 is affected by a cluster of vulnerabilities disclosed July 2026 and all fixed in 2.26. CVE-2026-48945 and CVE-2026-48946: a privileged K2 author can achieve RCE by uploading a PHP file (via the article attachment path, or a zip/tar extracted under /media/k2/galleries where non-image files keep their extension) and executing it. CVE-2026-48944: path traversal in the attachment copy handler lets an author copy configuration.php or other server files into /media/k2/attachments and download them. CVE-2026-48941: an unauthenticated request to the item.checkin task with a crafted sigProFolder parameter deletes arbitrary folders under /media/k2/galleries. CVE-2026-48940 and CVE-2026-48942: stored XSS via the embedVideo field and the K2 user image field. CVE-2026-48943: mass assignment via plg_user_k2 lets a registered user write arbitrary values to their own #__k2_users row. Update K2 to 2.26 or later.
Affected versions: < 2.26
Full advisory: cve.threatint.eu
K2 (com_k2) 1.0 to 2.26 - Unauthenticated Gallery Folder Deletion, Authenticated Arbitrary File Upload (RCE), Path Traversal and Stored XSS
K2 versions 1.0 to 2.26 are affected by six issues (CVE-2026-48941, CVE-2026-48942, CVE-2026-48943, CVE-2026-48944, CVE-2026-48945, CVE-2026-48946). The most serious needs no login at all: the frontend item.checkin task accepted a sigProFolder parameter and deleted the matching folder under /media/k2/galleries/ with no authentication, no CSRF token and no ownership check, so any anonymous visitor could wipe gallery contents with a single GET request. The other five require author or administrator access that a site administrator has explicitly granted, and are remote code execution via gallery ZIP extraction (non-image files, including .php, were left in place under the publicly served gallery folder), path traversal in the attachment 'existing' field, user property mass-assignment, and stored XSS. Fixed in K2 2.27, released 7 June 2026. K2 2.28 is the current release and also contains the fix. K2 2.26 does NOT contain the fix and is affected. Note that the CVE records contradict themselves on this point: all six are titled 'K2 extension for Joomla < 2.26' while their structured affected range reads 1.0-2.26. The vendor changelog settles it, because 2.26 (31 May 2026) is a YOOtheme Pro and PHP 8 compatibility release while 2.27 is the security release that names every one of these findings.
Affected versions: ≥ 1.0 and ≤ 2.26
Full advisory: github.com