What is the CVSS score of EUVD-2026-39439?

EUVD-2026-39439 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

K2 Extension EUVD-2026-39439

| CVE-2026-48942 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-25 Joomla

GHSA-5hmf-7m33-2v23

XSS K2 Extension For Joomla Getk2 Com

6.1

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered stored XSS with browser scope change; PR:N retained pending confirmation of unauthenticated write path to the image column.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:16 vuln.today

CVE Published

Jun 25, 2026 - 15:23 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

K2 ≤ 2.26 renders the #__k2_users.image column directly into HTML src attributes via two distinct templates, in both cases without HTML escaping.

AnalysisAI

Cross-site scripting in K2 Extension for Joomla (versions 1.0 through 2.26) exposes any site rendering K2 user profiles to JavaScript injection, because the #__k2_users.image database column is interpolated verbatim into HTML src attributes in two separate templates without HTML entity encoding. The CVSS 3.1 score of 6.1 reflects a scope-changed, network-reachable XSS with low attack complexity, though SSVC rates current exploitation as none and EPSS places it in the 4th percentile, indicating no observed mass exploitation at time of analysis. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.

Technical ContextAI

K2 Extension (CPE: cpe:2.3:a:getk2.com:k2_extension_for_joomla) is a content and user management component that extends the Joomla CMS with enhanced article, category, and user profile capabilities. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically an unsanitized database value passed directly into an HTML attribute context. Two distinct frontend templates retrieve the image column from the #__k2_users table and write it into src attributes without applying htmlspecialchars or equivalent escaping. An attacker-controlled string such as x" onerror="malicious() breaks out of the attribute value context, turning a passive data field into an active script execution point in any victim's browser. The dual-template nature of the flaw means the attack surface exists in at least two page views, not just one.

RemediationAI

No vendor-released patched version has been confirmed at time of analysis; the only reference provided points to the K2 homepage (https://www.getk2.org/) without naming a fixed release. Site operators should monitor the K2 changelog and upgrade as soon as a version beyond 2.26 addressing CWE-79 is published. As a compensating control, administrators should disable K2 user profile image upload and editing functionality in the K2 component configuration if the feature is not operationally required, which removes the injection vector while preserving read-only content display. A WAF rule that strips or encodes HTML metacharacters from requests targeting K2 user profile endpoints can also reduce exposure, though overly broad rules risk breaking legitimate image URL inputs. Additionally, deploying a Content Security Policy header with a restrictive script-src directive limits the blast radius of any XSS that does execute, preventing exfiltration to attacker-controlled domains.