# CVE-2026-48941: Joomla K2 extension unauthorized folder deletion in item.checkin task

Source: https://junglewise.ai/threats/cve-2026-48941-joomla-k2-extension-unauthorized-folder-deletion-in-item-checkin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-48941 · Severity: info · CVSS 0 · Published 2026-06-25

A vulnerability exists in K2, a popular content management extension for Joomla websites. An unauthorized user can trigger a specific task that deletes image gallery folders without any authentication. This could lead to the loss of website media content and disrupt the display of image galleries on the site.

Technologies: [JoomlaWorks K2](https://junglewise.ai/threats/technologies/k2). Vendors: [JoomlaWorks](https://junglewise.ai/threats/vendors/joomlaworks).

## Quick answers

**Is CVE-2026-48941 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48941 being exploited in the wild.

**How severe is CVE-2026-48941?** Informational severity, with a CVSS score of 0, published 25 June 2026.

**Which products and versions are affected?** JoomlaWorks K2 1.0-2.26.

**Is there a fix for CVE-2026-48941?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48941 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48941?** Check whether you run JoomlaWorks K2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The K2 frontend 'item.checkin' task fails to perform proper authorization checks (CWE-862). It accepts a 'sigProFolder' query parameter from unauthenticated users and passes it directly to a 'JFolder::delete()' call. This call is restricted to the '/media/k2/galleries/' directory, but allows for the deletion of arbitrary subfolders within that path. An attacker can exploit this via a simple network request to delete gallery content. The vulnerability affects versions 1.0 through 2.26.

## Affected products

- getk2.com K2 extension for Joomla 1.0-2.26

## Timeline

- 2026-06-25: disclosed: Vulnerability disclosed by the Joomla! Project
- 2026-06-25: advisory: NVD record published

## References

- [https://www.getk2.org/](https://www.getk2.org/)

## Related threats

- [Joomla K2 Extension Unrestricted File Upload in Article Attachments](https://junglewise.ai/threats/cve-2026-48946-joomla-k2-extension-unrestricted-file-upload-in-article)
- [Joomla K2 extension unrestricted file upload in article gallery upload](https://junglewise.ai/threats/cve-2026-48945-joomla-k2-extension-unrestricted-file-upload-in-article-gallery)
- [Joomla K2 path traversal in article-save handler](https://junglewise.ai/threats/cve-2026-48944-joomla-k2-path-traversal-in-article-save-handler)
- [JoomlaWorks K2 mass-assignment in plg_user_k2 plugin](https://junglewise.ai/threats/cve-2026-48943-joomlaworks-k2-mass-assignment-in-plg-user-k2-plugin)
- [Joomla K2 Extension Cross-Site Scripting in User Images](https://junglewise.ai/threats/cve-2026-48942-joomla-k2-extension-cross-site-scripting-in-user-images)