CVE-2026-48941

MEDIUM

Joomla Extension - getk2.com - Unauthenticated folder delete in K2 extension for Joomla < 2.26

Title source: cna
STIX 2.1

Description

The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::delete()` call under `/media/k2/galleries/`

References (1)

Core 1
Core References
Product product
https://www.getk2.org/

Scores

CVSS v3 6.5
EPSS 0.0016
EPSS Percentile 5.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (3)
getk2.com/K2 extension for Joomla 1.0-2.26
getk2.org/K2 extension for Joomla 1.0-2.26
joomlaworks/k2 < 2.26
Published Jun 25, 2026
Tracked Since Jun 25, 2026