EUVD-2026-39447
GHSA-6mmg-h49f-fj9x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Gallery upload is consistent with authenticated author-level access (PR:L); PHP execution in web-accessible path crosses privilege boundary (S:C) with full server impact (C:H/I:H/A:H).
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
The K2 article gallery upload path accepts a zip/tar archive, extracts it under /media/k2/galleries/<id>/, and only renames image files (gif/jpg/jpeg/png/webp) to safe names - non-image files (including .php) are extracted as-is and remain executable via direct HTTP access.
AnalysisAI
Unrestricted file upload in K2 Extension for Joomla (versions 1.0 through 2.26) permits attackers to embed PHP scripts inside zip or tar archives uploaded via the article gallery feature, which are then extracted as-is into the publicly accessible /media/k2/galleries/<id>/ directory and remain directly executable via HTTP. The extension applies renaming sanitization only to recognized image types, leaving PHP, shell, and other dangerous file types completely unfiltered post-extraction - a textbook CWE-434 flaw. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The K2 gallery archive upload feature must be enabled and reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The reported CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) materially misrepresents exploitation impact: placing an executable PHP webshell on a web server yields C:H/I:H/A:H - full server compromise - not merely low confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker constructs a zip archive containing a PHP webshell named `shell.php` alongside benign image files and submits it to the K2 gallery upload endpoint - which, per the CVSS PR:N rating, may require no authentication on affected installations. The extension extracts the archive, renames the image files to safe names, but writes `shell.php` verbatim to `/media/k2/galleries/<id>/shell.php`; the attacker then issues a direct HTTP GET to that path, receiving code execution under the web server process account with access to the Joomla database credentials, filesystem, and any secrets in the web root. … |
| Remediation | Upgrade K2 Extension for Joomla to the first patched release once published by the vendor at https://www.getk2.org/; no exact fixed version number was confirmed in the available reference data, so monitor the vendor site and ENISA EUVD-2026-39447 for patch availability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today