Executive brief
The K2 extension for Joomla, a popular tool for managing complex website content, contains a security flaw that allows users with article creation permissions to inject malicious scripts. By including a script in the video embed field of an article, an attacker can target any visitor who views that page. This could lead to unauthorized actions being performed in the visitor's browser, such as data theft or account hijacking.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the K2 extension for Joomla (versions 1.0 through 2.26). The issue resides in the 'embedVideo' POST field, which fails to properly sanitize or escape input before storage and subsequent rendering. An authenticated user with 'create item' rights (typically the Author tier) can submit a raw <script> tag that is stored verbatim in the database. When any visitor views the affected article, the script is executed in their browser context. This allows for session hijacking, defacement, or redirection to malicious sites.
Affected products
- getk2.com K2 extension for Joomla 1.0-2.26
Timeline
- 2026-06-25: disclosed