Executive brief
K2 is a popular content management extension for Joomla that provides advanced article and media features. A security vulnerability in versions 2.26 and earlier allows malicious data to be injected into user profile images. This could allow an attacker to execute unauthorized scripts in the browsers of other users, potentially leading to account takeover or the theft of sensitive session information.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the K2 extension for Joomla (versions <= 2.26). The root cause is the failure to perform HTML escaping on the `#__k2_users.image` database column before rendering it into the `src` attribute of HTML tags across two distinct templates. An attacker with the ability to modify their user profile image path or metadata could inject malicious payloads. When other users or administrators view the affected templates, the payload executes in their browser context, potentially allowing for session hijacking or unauthorized actions.
Affected products
- getk2.com K2 extension for Joomla 1.0-2.26
Timeline
- 2026-06-25: disclosed