MEDIUM
CVE-2026-48942
CVSS
6.1
Description
K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.
Summary dbcve.org
K2 component versions 2.26 and below contain a stored XSS vulnerability where the `#__k2_users.image` database column is rendered directly into HTML `src` attributes in two templates without proper HTML escaping. An attacker with user edit permissions could inject malicious JavaScript via the image field that executes when viewed by other users.
Mitigation
Apply output encoding/escaping to the image field before rendering into src attributes in both affected templates, or upgrade to K2 version >2.26 if a patched release is available.
Weakness (CWE)
CWE-79
Cross-site Scripting (XSS)
EPSS Score
0.25%
Probability of exploitation in next 30 days
17.1th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.