What is the CVSS score of EUVD-2026-39443?

EUVD-2026-39443 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

K2 for Joomla EUVD-2026-39443

| CVE-2026-48941 MEDIUM

Missing Authorization (CWE-862)

2026-06-25 Joomla

GHSA-xfx4-jrpq-pvcp

Authentication Bypass K2 Extension For Joomla Getk2 Com

6.5

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Unauthenticated network deletion of gallery directories produces integrity and availability impact (I:L, A:L); no confidentiality exposure from a delete-only operation justifies C:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 21:40 vuln.today

CVSS changed

Jun 25, 2026 - 19:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 25, 2026 - 15:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 25, 2026 - 15:25 cve.org

MEDIUM 6.5

DescriptionCVE.org

The K2 frontend item.checkin task accepts an unauthenticated sigProFolder query parameter and uses it directly to address a JFolder::delete() call under /media/k2/galleries/

AnalysisAI

Unauthorized folder deletion in the K2 Extension for Joomla (versions 1.0 through 2.26) exposes a public-facing item.checkin task that accepts an unauthenticated sigProFolder query parameter and passes it directly to JFolder::delete() under /media/k2/galleries/, with no authorization check whatsoever (CWE-862). Any unauthenticated remote attacker can trigger deletion of gallery directories simply by crafting an HTTP request - no session, token, or credentials required. No public exploit code has been identified at time of analysis, though SSVC rates this as automatable with partial technical impact, meaning scripted bulk targeting of affected Joomla installations is straightforward.

Technical ContextAI

K2 is a content management extension for Joomla CMS, providing structured item/article management with associated media galleries stored on the filesystem under /media/k2/galleries/. The item.checkin task is a frontend controller action that is normally intended for authenticated editorial workflows, but the sigProFolder parameter accepted by this task is consumed without a Joomla ACL (Access Control List) check before being handed to JFolder::delete() - a legitimate Joomla platform API for recursive directory removal. The root cause is CWE-862 (Missing Authorization): the platform-level deletion capability is reachable without enforcing that the caller holds any privilege. The CPE string cpe:2.3:a:getk2.com:k2_extension_for_joomla:*:*:*:*:*:*:*:* covers all K2 versions, with EUVD data bounding the confirmed affected range at 1.0 through 2.26. Whether sigProFolder also lacks path-traversal sanitization (CWE-22) is implied by the unfiltered pass-through described but is not independently confirmed as a separately enumerated weakness.

RemediationAI

Upgrade K2 to a release beyond version 2.26 once the vendor publishes a patched build at https://www.getk2.org/ - no exact patched version number is confirmed in the currently available references, so verify the official K2 changelog before deploying any update. If a vendor-released patch is not yet available, the most targeted compensating control is to block HTTP requests that combine the K2 frontend parameter task=item.checkin with a sigProFolder value at the WAF or web-server layer (e.g., via an nginx deny rule or ModSecurity rule targeting this parameter combination); this may break legitimate editorial checkin workflows for authenticated users, so coordinate with content teams before applying. As a secondary defense-in-depth measure, restrict write permissions on /media/k2/galleries/ so the web server process holds only the minimum required access - on a read-heavy site this could be tightened to read-only for the web user, though this would also prevent legitimate gallery uploads until the patch is applied.