Quick answers
- Is CVE-2026-48941 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48941 being exploited in the wild.
- How severe is CVE-2026-48941?
- Informational severity, with a CVSS score of 0, published 25 June 2026.
- Which products and versions are affected?
- JoomlaWorks K2 1.0-2.26.
- Is there a fix for CVE-2026-48941?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-48941 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-48941?
- Check whether you run JoomlaWorks K2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The K2 frontend 'item.checkin' task fails to perform proper authorization checks (CWE-862). It accepts a 'sigProFolder' query parameter from unauthenticated users and passes it directly to a 'JFolder::delete()' call. This call is restricted to the '/media/k2/galleries/' directory, but allows for the deletion of arbitrary subfolders within that path. An attacker can exploit this via a simple network request to delete gallery content. The vulnerability affects versions 1.0 through 2.26.
Affected products
- getk2.com K2 extension for Joomla 1.0-2.26
Timeline
- 2026-06-25: disclosed: Vulnerability disclosed by the Joomla! Project
- 2026-06-25: advisory: NVD record published