CVE-2026-48945: K2 Joomla Gallery Upload Remote Code Execution

Technical summary

CVE-2026-48945 is an unrestricted file upload vulnerability (CWE-434) in the K2 gallery upload functionality. The affected code path accepts compressed archives, extracts contents to `/media/k2/galleries/<id>/`, and applies filename sanitization only to recognized image extensions. Non-image files bypass this filter entirely. Since the extraction directory is beneath the web root and directly accessible, any uploaded executable (PHP, HTAccess, etc.) becomes immediately callable via HTTP GET/POST requests, leading to arbitrary code execution under the web server's privilege level.

Business impact

An unauthenticated attacker can upload a malicious PHP file disguised within an archive to gain remote code execution on the Joomla server. This enables full compromise of the website, data exfiltration, malware distribution, defacement, and lateral movement into the internal network. Organizations running K2 galleries without additional upload controls face significant risk of brand damage, compliance violations, customer data loss, and operational downtime.

Affected systems

JoomlaWorks K2 component is affected. The vulnerability exists in the gallery upload handler and impacts any Joomla installation with K2 installed and the gallery feature accessible. Versions prior to the patched release are vulnerable; verify the specific version cutoff against the official JoomlaWorks advisory.

Exploitability

Exploitability is straightforward and requires no authentication or user interaction. An attacker simply crafts a ZIP archive containing a PHP webshell alongside benign image files, uploads it via the gallery feature, and accesses the uploaded PHP file directly. The CVSS score of 5.3 (Medium) reflects the low complexity and network accessibility, though the limited scope and information-disclosure nature of the current vector suggest real-world impact may be higher if combined with other Joomla vulnerabilities.

Remediation

Apply the latest security patch from JoomlaWorks as soon as it is released. The patch should enforce strict file-type validation and whitelist image extensions at upload time, reject non-image files explicitly, or store extracted files outside the web root. Until patching is complete, disable the K2 gallery upload feature or restrict access to trusted administrators only via Joomla ACLs.

Patch guidance

Monitor JoomlaWorks official channels and the Joomla Security Center for K2 update notifications. When available, apply patches immediately through the Joomla extension manager. Verify the patched version in release notes confirms the upload handler now rejects or quarantines non-image files. Test in a staging environment to ensure compatibility with your Joomla version and custom K2 configurations before production deployment.

Detection guidance

Look for .php or other executable files in `/media/k2/galleries/*/` directories that do not match expected image names or timestamps. Monitor web server access logs for HTTP requests to .php files within the k2/galleries path. Implement file integrity monitoring (FIM) on the galleries directory to detect unauthorized file creation. Review recent K2 gallery uploads for unusual archive names or timing. Consider Web Application Firewall (WAF) rules to block direct HTTP access to non-image files under /media/k2/galleries/.

Why prioritize this

Although the CVSS score is Medium, this vulnerability warrants prompt attention because it allows unauthenticated remote code execution, a critical business impact. K2 is widely deployed in Joomla sites; the ease of exploitation and lack of KEV designation suggest it has not yet become a mainstream attack target, but the low barrier to weaponization makes early patching essential to avoid opportunistic compromise.

Risk score, explained

The CVSS 3.1 score of 5.3 is based on network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), and unchanged scope (S:U). The impact is limited to confidentiality (C:L) because the vector assesses information disclosure; however, in practice, code execution enables integrity and availability impacts as well, so organizations should treat real-world risk as significantly higher than the base score suggests.

Frequently asked questions