CVE-2026-48942: Joomlaworks k2

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.

Affected products

• Joomlaworks k2: up to and including 2.26

Published 2026-06-25. Last modified 2026-06-28.