← All advisories

Medium severity6.1NVD Advisory· Published Jun 25, 2026· Updated Jun 28, 2026

CVE-2026-48942

CVE-2026-48942

Description

K2 ≤ 2.26 renders the #__k2_users.image column directly into HTML src attributes via two distinct templates, in both cases without HTML escaping.

Affected products

1

Joomlaworks/K2
cpe:2.3:a:joomlaworks:k2:*:*:*:*:*:joomla\!:*:*
Range: <=2.26

Patches

Vulnerability mechanics

References

1

www.getk2.orgnvdProduct

News mentions

0

No linked articles in our index yet.