Executive brief
K2 is a popular content management extension for Joomla websites used to manage articles and media galleries. A security flaw in the gallery upload feature allows users with upload permissions to bypass security checks by hiding malicious files inside compressed archives. If exploited, an attacker could take full control of the website by executing arbitrary code on the server.
Technical details
An unrestricted file upload vulnerability exists in the K2 extension for Joomla (versions 1.0 through 2.26) within the article gallery upload component. When a user uploads a zip or tar archive, the extension extracts the contents to `/media/k2/galleries/<id>/`. While the system renames recognized image formats (gif, jpg, jpeg, png, webp) to safe filenames, it fails to sanitize or rename other file types. Consequently, an attacker with gallery upload privileges can include a PHP script within an archive, which remains executable via direct HTTP access after extraction, leading to full remote code execution (RCE).
Affected products
- getk2.com K2 extension for Joomla 1.0-2.26
Timeline
- 2026-06-25: disclosed: CVE published by the Joomla! Project