CVE-2026-48945

The K2 article gallery upload path accepts a zip/tar archive, extracts it under "/media/k2/galleries//", and only renames image files gif/jpg/jpeg/png/webp to safe names — non-image files including ".php" are extracted as-is and remain executable via direct HTTP access...