← Vulnerability feed

Vulnerability record · CVE-2026-48942 · published 25 June 2026

CVE-2026-48942: Joomlaworks k2 cross-site scripting vulnerability

Joomlaworks · K2

K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.

6.1 CVSS 3.1 Medium EPSS 0.25% · top 84.9% CWE-79 · Cross-site scripting
6.1CVSS 3.1 base score
0.25%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
28 Jun 2026Last modified by NVD

Description

K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.getk2.org/ Product

Track CVE-2026-48942 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-19634Verot project verot unrestricted file upload vulnerabilityclass.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .ph…EPSS 4.2%9.8CVE-2019-19576Verot project verot unrestricted file upload vulnerabilityclass.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar…EPSS 26%7.5CVE-2018-7482Joomlaworks k2 path traversal vulnerabilityThe K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker to download arbitrary files, as demons…EPSS 2.3%6.5CVE-2026-48941Joomlaworks k2 missing authorization vulnerabilityThe K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::delete()` c…EPSS 0.27%6.5CVE-2026-48943Joomlaworks k2 mass assignment vulnerabilityK2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=…EPSS 0.30%6.5CVE-2026-48944Joomlaworks k2 path traversal vulnerabilityThe K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH_SITE/` and passed to `JFile::co…EPSS 0.44%6.3CVE-2026-48946Joomlaworks k2 unrestricted file upload vulnerabilityThe K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php matches `\.php$` and executes t…EPSS 0.28%5.3CVE-2026-48945Joomlaworks k2 unrestricted file upload vulnerabilityThe K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, and only renames image files (gif/jpg/jp…EPSS 0.33%

Source: NIST National Vulnerability Database (record CVE-2026-48942), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.