CVE-2026-48942: Improper Neutralization of Input During Web Page Generation

K2 ≤ 2.26 renders the k2users.image column directly into HTML src attributes via two distinct templates, in both cases without HTML escaping...