EUVD-2026-39447
GHSA-6mmg-h49f-fj9x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Gallery upload is consistent with authenticated author-level access (PR:L); PHP execution in web-accessible path crosses privilege boundary (S:C) with full server impact (C:H/I:H/A:H).
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
3DescriptionCVE.org
The K2 article gallery upload path accepts a zip/tar archive, extracts it under /media/k2/galleries/<id>/, and only renames image files (gif/jpg/jpeg/png/webp) to safe names - non-image files (including .php) are extracted as-is and remain executable via direct HTTP access.
AnalysisAI
Unrestricted file upload in K2 Extension for Joomla (versions 1.0 through 2.26) permits attackers to embed PHP scripts inside zip or tar archives uploaded via the article gallery feature, which are then extracted as-is into the publicly accessible /media/k2/galleries/<id>/ directory and remain directly executable via HTTP. The extension applies renaming sanitization only to recognized image types, leaving PHP, shell, and other dangerous file types completely unfiltered post-extraction - a textbook CWE-434 flaw. No public exploit has been identified at time of analysis, but the reported CVSS base vector (AV:N/AC:L/PR:N/UI:N) and the nature of the flaw indicate trivial exploitability; notably, the reported CVSS impact metrics (C:L/I:N/A:N) appear to significantly understate the actual consequence of achieving arbitrary PHP code execution on the server.
Technical ContextAI
K2 Extension for Joomla (CPE: cpe:2.3:a:getk2.com:k2_extension_for_joomla:*:*:*:*:*:*:*:*) is a Joomla CMS component providing advanced article and gallery management. The gallery upload pathway accepts compressed archive formats (zip, tar), decompresses their contents into /media/k2/galleries/<id>/ - a directory served directly by the web server - and applies a file-rename sanitization step exclusively to files bearing recognized image extensions (gif, jpg, jpeg, png, webp). This design omits any validation, renaming, or execution prevention for all other file types, including PHP scripts. CWE-434 (Unrestricted Upload of File with Dangerous Type) precisely describes this root cause: the application fails to enforce an allowlist of safe content types before writing extracted files to a web-accessible, PHP-executable path. Because Joomla deployments default to enabling PHP execution across the web root and its subdirectories, any .php file reaching this directory is immediately callable by a remote HTTP request, making the upload-then-execute chain atomic and requiring no post-upload privilege escalation.
RemediationAI
Upgrade K2 Extension for Joomla to the first patched release once published by the vendor at https://www.getk2.org/; no exact fixed version number was confirmed in the available reference data, so monitor the vendor site and ENISA EUVD-2026-39447 for patch availability. As an immediate compensating control, disable the gallery archive upload feature in K2 component settings - this eliminates the attack vector entirely but prevents legitimate bulk image uploads via archives. If disabling the feature is operationally unacceptable, add an Apache .htaccess file to /media/k2/galleries/ containing php_flag engine off (or the nginx equivalent location ~ /media/k2/galleries/.*\.php { deny all; }) to prevent PHP execution in that directory; note this does not prevent upload of malicious files but blocks their execution, and must be re-verified after any Joomla or server update that could overwrite .htaccess. As a defense-in-depth measure, deploy a WAF rule to inspect multipart archive uploads for embedded PHP content on the gallery upload endpoint, accepting the trade-off of minor false-positive risk on archives containing non-PHP scripts.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today