CVE-2026-48941: Joomlaworks k2

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::delete()` call under `/media/k2/galleries/`

Affected products

• Joomlaworks k2: up to and including 2.26

Published 2026-06-25. Last modified 2026-06-28.