Skip to main content
mySites.guru
Free Audit
CriticalPHP2Shell is fixed, but a researcher now claims six more unpatched PHP flaws. Nothing to do today, but PHP is not out of the woodsWhat to prepare

K2 security vulnerabilities

mySites.guru tracks 2 vulnerabilities in K2 (com_k2), covering 7 CVEs. Every connected Joomla site is checked against them on each audit.

Is my site affected?

Your site is affected if it runs K2 in any of these ranges:

  • before 2.26
  • from 1.0 up to and including 2.26
Latest safe version
The rules here cover more than one release line, so there is no single version that clears all of them. Use the fixed release listed for the line your site runs.
What to do
Update to the fixed release listed for your version in the table below, or to the newest release from the vendor. Where a range has no fix recorded, check the vendor's release notes before keeping K2 installed.
Check whether your sites are affected

Every K2 vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
CVE-2026-48941CVSS 6.5CVE-2026-48942CVSS 6.1CVE-2026-48943CVSS 6.5CVE-2026-48944CVSS 6.5CVE-2026-48945CVSS 5.3CVE-2026-48946CVSS 6.3from 1.0 up to and including 2.26after 2.26Medium2026-06-25
CVE-2026-48940CVSS 3.4before 2.262.26Critical2026-01-01

What we check for

CriticalCVE-2026-489402026-01-01

K2 (com_k2) below 2.26 - CVE-2026-48940 to 48946 - Multiple RCE (unrestricted upload), Path Traversal, Stored XSS, Unauthenticated Folder Delete and Mass Assignment

K2 by JoomlaWorks before 2.26 is affected by a cluster of vulnerabilities disclosed July 2026 and all fixed in 2.26. CVE-2026-48945 and CVE-2026-48946: a privileged K2 author can achieve RCE by uploading a PHP file (via the article attachment path, or a zip/tar extracted under /media/k2/galleries where non-image files keep their extension) and executing it. CVE-2026-48944: path traversal in the attachment copy handler lets an author copy configuration.php or other server files into /media/k2/attachments and download them. CVE-2026-48941: an unauthenticated request to the item.checkin task with a crafted sigProFolder parameter deletes arbitrary folders under /media/k2/galleries. CVE-2026-48940 and CVE-2026-48942: stored XSS via the embedVideo field and the K2 user image field. CVE-2026-48943: mass assignment via plg_user_k2 lets a registered user write arbitrary values to their own #__k2_users row. Update K2 to 2.26 or later.

Affected versions: < 2.26

Full advisory: cve.threatint.eu

MediumCVE-2026-48941CVE-2026-48942CVE-2026-48943CVE-2026-48944CVE-2026-48945CVE-2026-489462026-06-25

K2 (com_k2) 1.0 to 2.26 - Unauthenticated Gallery Folder Deletion, Authenticated Arbitrary File Upload (RCE), Path Traversal and Stored XSS

K2 versions 1.0 to 2.26 are affected by six issues (CVE-2026-48941, CVE-2026-48942, CVE-2026-48943, CVE-2026-48944, CVE-2026-48945, CVE-2026-48946). The most serious needs no login at all: the frontend item.checkin task accepted a sigProFolder parameter and deleted the matching folder under /media/k2/galleries/ with no authentication, no CSRF token and no ownership check, so any anonymous visitor could wipe gallery contents with a single GET request. The other five require author or administrator access that a site administrator has explicitly granted, and are remote code execution via gallery ZIP extraction (non-image files, including .php, were left in place under the publicly served gallery folder), path traversal in the attachment 'existing' field, user property mass-assignment, and stored XSS. Fixed in K2 2.27, released 7 June 2026. K2 2.28 is the current release and also contains the fix. K2 2.26 does NOT contain the fix and is affected. Note that the CVE records contradict themselves on this point: all six are titled 'K2 extension for Joomla < 2.26' while their structured affected range reads 1.0-2.26. The vendor changelog settles it, because 2.26 (31 May 2026) is a YOOtheme Pro and PHP 8 compatibility release while 2.27 is the security release that names every one of these findings.

Affected versions: ≥ 1.0 and ≤ 2.26

Full advisory: github.com

Timeline

  1. 1 January 2026Check added for CVE-2026-48940 (before 2.26)
  2. 25 June 2026Check added for CVE-2026-48941, CVE-2026-48942, CVE-2026-48943, CVE-2026-48944, CVE-2026-48945 and CVE-2026-48946 (from 1.0 up to and including 2.26)
  3. 25 June 2026CVE-2026-48940 record published
  4. 25 June 2026CVE-2026-48941 record published
  5. 25 June 2026CVE-2026-48942 record published
  6. 25 June 2026CVE-2026-48943 record published
  7. 25 June 2026CVE-2026-48944 record published
  8. 25 June 2026CVE-2026-48945 record published
  9. 25 June 2026CVE-2026-48946 record published

References

Each CVE page above links its official cve.org record and its NVD entry.

K2 vulnerability questions

Which versions of K2 are vulnerable?
mySites.guru tracks 2 vulnerabilities in K2 (com_k2). A site is affected if its installed version is in any of these ranges: before 2.26; from 1.0 up to and including 2.26.
What is the latest safe version of K2?
The rules here cover more than one release line, so there is no single version that clears all of them. Use the fixed release listed for the line your site runs.
How do I check which version of K2 my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com_k2. mySites.guru reads the installed version on every audit of a connected site and checks it against these rules.

Running K2 on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

CVE identifiers: CVE-2026-48940, CVE-2026-48941, CVE-2026-48942, CVE-2026-48943, CVE-2026-48944, CVE-2026-48945, CVE-2026-48946. Rules current as of 25 October 2026.