PatchTheCVEk2 vulnerabilities and fixes
Recent CVEs affecting k2, with upgrade or downgrade steps. 7 tracked.
k2 has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 7. Most recent: 2026-06-25. Highest priority: CVE-2026-48943 (score 33/100).
- CVE-2026-48943 MEDIUM 6.5 UPGRADE K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`
- CVE-2026-48941 MEDIUM 6.5 UPGRADE The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it dire
- CVE-2026-48944 MEDIUM 6.5 UPGRADE The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with
- CVE-2026-48946 MEDIUM 6.3 UPGRADE The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard
- CVE-2026-48945 MEDIUM 5.3 UPGRADE The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, a
- CVE-2026-48942 MEDIUM 6.1 UPGRADE K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct template
- CVE-2026-48940 LOW 3.4 UPGRADE A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` P
FAQ
How do I fix k2 vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is k2 being exploited right now?
None of the tracked k2 CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which k2 CVE should I patch first?
CVE-2026-48943 currently ranks highest (33/100): K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`.