CVE-2026-48941: K2 Joomla Unauthenticated Gallery Folder Deletion Vulnerability

Technical summary

The K2 frontend handler for the `item.checkin` task fails to validate or authenticate the `sigProFolder` query parameter before passing it to `JFolder::delete()`. This parameter is used directly to construct a filesystem path under `/media/k2/galleries/`, enabling path traversal and arbitrary folder deletion. The vulnerability stems from missing access control (CWE-862) and insufficient input sanitization. The attack surface is network-accessible and requires no prior authentication or user interaction.

Business impact

Organizations running K2-powered Joomla sites face risk of unauthorized deletion of gallery content and media assets. This can result in data loss, site defacement, disruption of user-facing media galleries, and potential business continuity issues if critical gallery content is removed. Attackers could also use this as part of a broader attack chain to disable features or trigger secondary incidents. No confidentiality breach occurs, but integrity and availability are compromised.

Affected systems

Joomlaworks K2 component is affected. The vulnerability is triggered via the unauthenticated `item.checkin` frontend task, meaning any Joomla site with K2 installed and enabled is potentially vulnerable. Specific version boundaries have not been disclosed in available advisories; organizations should verify patch availability from Joomlaworks and test in their environment.

Exploitability

Exploitation is straightforward and requires no authentication, special privileges, or user interaction. An attacker can send a simple HTTP request with a crafted `sigProFolder` parameter to delete folders. The network accessibility and low complexity make this a practical attack vector. However, exploitation is not yet weaponized or listed in the KEV catalog, suggesting limited public active exploitation at the time of publication.

Remediation

Apply a patch from Joomlaworks that validates and sanitizes the `sigProFolder` parameter and enforces authentication on the `item.checkin` task. Until a patch is available or applied, restrict network access to the K2 component or disable it if not in use. Implement Web Application Firewall (WAF) rules to block requests to `item.checkin` with suspicious `sigProFolder` values, and monitor gallery folder modifications for unauthorized deletions.

Patch guidance

Contact Joomlaworks directly or check their security advisories for the availability of a patched K2 version. After obtaining and testing the patch in a staging environment, deploy it to production. Verify that the `item.checkin` task now requires proper authentication and that the `sigProFolder` parameter is validated against an allowlist of legitimate paths. Monitor K2 release notes and security channels for follow-up advisories.

Detection guidance

Log and monitor requests to the K2 `item.checkin` task, particularly those containing the `sigProFolder` parameter. Alert on any unauthenticated access attempts to this endpoint. Review web server and Joomla logs for successful deletions in `/media/k2/galleries/` directories, especially if they correlate with suspicious requests. File integrity monitoring (FIM) can detect unauthorized folder and file deletions in real-time.

Why prioritize this

Although rated MEDIUM severity, this vulnerability warrants prompt attention because exploitation is trivial (network-accessible, no authentication required) and impact is direct (data loss). K2 is a widely-used Joomla extension, increasing the footprint. Organizations should patch promptly to close an easily-exploited attack vector, even though it does not enable code execution or full system compromise.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects network accessibility and low attack complexity, balanced against the absence of authentication bypass (PR:N, no required privileges) and limited scope impact (partial integrity and confidentiality loss, no availability impact in the CVSS model, though folder deletion does affect availability in practice). The score appropriately flags this as a meaningful but not critical risk.

Frequently asked questions