Unrated severityNVD Advisory· Published Jun 25, 2026· Updated Jun 28, 2026
Joomla Extension - getk2.org - Unauthenticated folder delete in K2 extension for Joomla < 2.26
CVE-2026-48941
Description
The K2 frontend item.checkin task accepts an unauthenticated sigProFolder query parameter and uses it directly to address a JFolder::delete() call under /media/k2/galleries/
Affected products
1- Range: <2.26
Patches
Vulnerability mechanics
References
1- www.getk2.orgmitreproduct
News mentions
0No linked articles in our index yet.