CVE-2026-48945 PUBLISHED

Joomla Extension - getk2.com - Privileged RCE vulnerability in K2 extension for Joomla < 2.26

Assigner: Joomla
Reserved: 26.05.2026 Published: 25.06.2026 Updated: 25.06.2026

The K2 article gallery upload path accepts a zip/tar archive, extracts it under /media/k2/galleries/<id>/, and only renames image files (gif/jpg/jpeg/png/webp) to safe names — non-image files (including .php) are extracted as-is and remain executable via direct HTTP access.

Product Status

Vendor getk2.com
Product K2 extension for Joomla
Versions Default: unaffected
  • Version 1.0-2.26 is affected

Credits

  • Matan Bahar finder

References

Problem Types

  • CWE-434 Unrestricted Upload via archive extraction CWE