Executive brief
A vulnerability exists in K2, a popular content management extension for Joomla websites. An unauthorized user can trigger a specific task that deletes image gallery folders without any authentication. This could lead to the loss of website media content and disrupt the display of image galleries on the site.
Technical details
The K2 frontend 'item.checkin' task fails to perform proper authorization checks (CWE-862). It accepts a 'sigProFolder' query parameter from unauthenticated users and passes it directly to a 'JFolder::delete()' call. This call is restricted to the '/media/k2/galleries/' directory, but allows for the deletion of arbitrary subfolders within that path. An attacker can exploit this via a simple network request to delete gallery content. The vulnerability affects versions 1.0 through 2.26.
Affected products
- getk2.com K2 extension for Joomla 1.0-2.26
Timeline
- 2026-06-25: disclosed: Vulnerability disclosed by the Joomla! Project
- 2026-06-25: advisory: NVD record published