# CVE-2026-48942: Joomla K2 Extension Cross-Site Scripting in User Images

Source: https://junglewise.ai/threats/cve-2026-48942-joomla-k2-extension-cross-site-scripting-in-user-images  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-48942 · Severity: info · CVSS 0 · Published 2026-06-25

K2 is a popular content management extension for Joomla that provides advanced article and media features. A security vulnerability in versions 2.26 and earlier allows malicious data to be injected into user profile images. This could allow an attacker to execute unauthorized scripts in the browsers of other users, potentially leading to account takeover or the theft of sensitive session information.

Technologies: [JoomlaWorks K2](https://junglewise.ai/threats/technologies/k2). Vendors: [JoomlaWorks](https://junglewise.ai/threats/vendors/joomlaworks).

## Quick answers

**Is CVE-2026-48942 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48942 being exploited in the wild.

**How severe is CVE-2026-48942?** Informational severity, with a CVSS score of 0, published 25 June 2026.

**Which products and versions are affected?** JoomlaWorks K2 1.0-2.26.

**Is there a fix for CVE-2026-48942?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48942 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48942?** Check whether you run JoomlaWorks K2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the K2 extension for Joomla (versions <= 2.26). The root cause is the failure to perform HTML escaping on the `#__k2_users.image` database column before rendering it into the `src` attribute of HTML tags across two distinct templates. An attacker with the ability to modify their user profile image path or metadata could inject malicious payloads. When other users or administrators view the affected templates, the payload executes in their browser context, potentially allowing for session hijacking or unauthorized actions.

## Affected products

- getk2.com K2 extension for Joomla 1.0-2.26

## Timeline

- 2026-06-25: disclosed

## References

- [https://www.getk2.org/](https://www.getk2.org/)

## Related threats

- [Joomla K2 Extension Unrestricted File Upload in Article Attachments](https://junglewise.ai/threats/cve-2026-48946-joomla-k2-extension-unrestricted-file-upload-in-article)
- [Joomla K2 extension unrestricted file upload in article gallery upload](https://junglewise.ai/threats/cve-2026-48945-joomla-k2-extension-unrestricted-file-upload-in-article-gallery)
- [Joomla K2 path traversal in article-save handler](https://junglewise.ai/threats/cve-2026-48944-joomla-k2-path-traversal-in-article-save-handler)
- [JoomlaWorks K2 mass-assignment in plg_user_k2 plugin](https://junglewise.ai/threats/cve-2026-48943-joomlaworks-k2-mass-assignment-in-plg-user-k2-plugin)
- [Joomla K2 extension unauthorized folder deletion in item.checkin task](https://junglewise.ai/threats/cve-2026-48941-joomla-k2-extension-unauthorized-folder-deletion-in-item-checkin)