CVE-2026-48945
Description
The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, and only renames image files (gif/jpg/jpeg/png/webp) to safe names — non-image files (including `.php`) are extracted as-is and remain executable via direct HTTP access.
Summary dbcve.org
The K2 component for Joomla allows authenticated users to upload zip/tar archives containing images for article galleries. During extraction to /media/k2/galleries/<id>/, only image files (gif/jpg/jpeg/png/webp) are renamed to safe filenames, while non-image files like .php are extracted with their original names and remain executable via direct HTTP access, enabling remote code execution.
Mitigation
Immediately restrict archive extraction to only process whitelisted image file types, or move the extraction directory outside the webroot. Alternatively, disable the gallery upload feature until a patch is available.