CVE-2026-48945: Joomlaworks k2

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, and only renames image files (gif/jpg/jpeg/png/webp) to safe names — non-image files (including `.php`) are extracted as-is and remain executable via direct HTTP access.

Affected products

• Joomlaworks k2: up to and including 2.26

Published 2026-06-25. Last modified 2026-06-28.