CVE-2026-48945 Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26

The K2 article gallery upload path accepts a zip/tar archive, extracts it under /media/k2/galleries//, and only renames image files gif/jpg/jpeg/png/webp to safe names — non-image files including .php are extracted as-is and remain executable via direct HTTP access...

CVE-2026-48942

Affected software: K2 extension for Joomla (getk2.com), version constraint listed as K2 ≤ 2.26. Vulnerability: two templates render the database column __#k2_users.image directly into HTML src attributes without HTML escaping, revealing a stored-XSS risk. Root cause: lack of escaping when injecti...

Joomla JE K2 Multiple Form Story Component SQL Injection Vulnerability

Joomla is an open source content management system CMS. A SQL injection vulnerability exists in the Joomla JE K2 Multiple Form Story component, which can be exploited by attackers to access or modify database data...

Multiple K2 Products SQL Injection Vulnerabilities

K2 blackpearl, smartforms, and K2 for SharePoint are all products from K2 Corporation. blackpearl is a suite of applications for building and running business processes. smartforms is an online business system push messaging product. k2 for SharePoint is a suite of applications for creating forms...