EUVD-2026-39439

K2 ≤ 2.26 renders the k2users.image column directly into HTML src attributes via two distinct templates, in both cases without HTML escaping...

PT-2026-52465

K2 ≤ 2.26 renders the k2 users.image column directly into HTML src attributes via two distinct templates, in both cases without HTML escaping...