By vendor

Joomlaworks vulnerabilities

Known CVEs affecting Joomlaworks products, prioritized by severity, with SEC.co remediation and detection guidance.

6 published vulnerabilities

• CVE-2026-48943MEDIUM 6.5

  K2, a popular content component for Joomla, has a flaw in how it handles user profile updates. When a registered Joomla user submits a profile edit through the standard Joomla user management system, they can inject a special parameter that tricks K2 into letting them modify hidden database fields—specifically their notes, profile image, and plugin settings—that the normal K2 interface doesn't expose. This allows unauthorized modification of user profile data that should be restricted to administrators.

• CVE-2026-48944MEDIUM 6.5

  A flaw in the K2 component for Joomla allows authenticated users with Author privileges to read sensitive files from the server. By manipulating a form field during article uploads, an attacker can copy files like configuration.php or system files into a publicly accessible directory, then download them to extract credentials, database details, or other secrets. The vulnerability requires valid site credentials but poses a significant confidentiality risk.

• CVE-2026-48946MEDIUM 6.3

  K2, a popular Joomla extension for content management, contains a file upload vulnerability in its article attachment feature. Authors can upload PHP files that the web server will execute, allowing them to run arbitrary code with the privileges of the web server. This is a privilege escalation risk: a user with basic author permissions can gain code execution on the server.

• CVE-2026-48942MEDIUM 6.1

  CVE-2026-48942 is a cross-site scripting (XSS) vulnerability in JoomlaWorks K2 version 2.26 and earlier. The vulnerability exists because user profile images are inserted directly into HTML without proper sanitization. An attacker who can upload or modify a user profile image can craft a malicious image filename or source that executes JavaScript in the browsers of anyone viewing that profile. This requires user interaction (clicking or viewing a profile page) and affects only the user's current browser session and site context, but could be used to steal session cookies, redirect users, or deface content.

• CVE-2026-48945MEDIUM 5.3

  K2, a popular article management component for Joomla, contains a vulnerability in its gallery upload feature. When users upload ZIP or TAR archives containing images, the system extracts them to a web-accessible directory but only safely renames actual image files (GIF, JPG, JPEG, PNG, WebP). Non-image files—critically, PHP scripts—are extracted with their original names and remain executable. An attacker can upload an archive containing a PHP webshell alongside legitimate images, and then directly access the shell via HTTP to execute arbitrary code on the server.

• CVE-2026-48940LOW 3.4

  A K2 component vulnerability in Joomla allows authenticated users with Author-level permissions to inject unescaped JavaScript code into articles. When a user with "create item" rights submits an article and embeds malicious script tags in the `embedVideo` field, K2 stores and displays that code without sanitization, causing it to execute in visitors' browsers. This is a stored cross-site scripting (XSS) vulnerability that requires an attacker to already have article creation privileges—a relatively high bar that limits exposure in most Joomla deployments.