What is the CVSS score of EUVD-2026-39447?

EUVD-2026-39447 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

K2 Extension Joomla EUVD-2026-39447

| CVE-2026-48945 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-25 Joomla

GHSA-6mmg-h49f-fj9x

PHP File Upload K2 Extension For Joomla Getk2 Com

5.3

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

9.9 CRITICAL

Gallery upload is consistent with authenticated author-level access (PR:L); PHP execution in web-accessible path crosses privilege boundary (S:C) with full server impact (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 19:24 vuln.today

CVSS changed

Jun 25, 2026 - 19:22 NVD

5.3 (MEDIUM)

CVE Published

Jun 25, 2026 - 15:26 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The K2 article gallery upload path accepts a zip/tar archive, extracts it under /media/k2/galleries/<id>/, and only renames image files (gif/jpg/jpeg/png/webp) to safe names - non-image files (including .php) are extracted as-is and remain executable via direct HTTP access.

AnalysisAI

Unrestricted file upload in K2 Extension for Joomla (versions 1.0 through 2.26) permits attackers to embed PHP scripts inside zip or tar archives uploaded via the article gallery feature, which are then extracted as-is into the publicly accessible /media/k2/galleries/<id>/ directory and remain directly executable via HTTP. The extension applies renaming sanitization only to recognized image types, leaving PHP, shell, and other dangerous file types completely unfiltered post-extraction - a textbook CWE-434 flaw. No public exploit has been identified at time of analysis, but the reported CVSS base vector (AV:N/AC:L/PR:N/UI:N) and the nature of the flaw indicate trivial exploitability; notably, the reported CVSS impact metrics (C:L/I:N/A:N) appear to significantly understate the actual consequence of achieving arbitrary PHP code execution on the server.

Technical ContextAI

K2 Extension for Joomla (CPE: cpe:2.3:a:getk2.com:k2_extension_for_joomla:*:*:*:*:*:*:*:*) is a Joomla CMS component providing advanced article and gallery management. The gallery upload pathway accepts compressed archive formats (zip, tar), decompresses their contents into /media/k2/galleries/<id>/ - a directory served directly by the web server - and applies a file-rename sanitization step exclusively to files bearing recognized image extensions (gif, jpg, jpeg, png, webp). This design omits any validation, renaming, or execution prevention for all other file types, including PHP scripts. CWE-434 (Unrestricted Upload of File with Dangerous Type) precisely describes this root cause: the application fails to enforce an allowlist of safe content types before writing extracted files to a web-accessible, PHP-executable path. Because Joomla deployments default to enabling PHP execution across the web root and its subdirectories, any .php file reaching this directory is immediately callable by a remote HTTP request, making the upload-then-execute chain atomic and requiring no post-upload privilege escalation.

RemediationAI

Upgrade K2 Extension for Joomla to the first patched release once published by the vendor at https://www.getk2.org/; no exact fixed version number was confirmed in the available reference data, so monitor the vendor site and ENISA EUVD-2026-39447 for patch availability. As an immediate compensating control, disable the gallery archive upload feature in K2 component settings - this eliminates the attack vector entirely but prevents legitimate bulk image uploads via archives. If disabling the feature is operationally unacceptable, add an Apache .htaccess file to /media/k2/galleries/ containing php_flag engine off (or the nginx equivalent location ~ /media/k2/galleries/.*\.php { deny all; }) to prevent PHP execution in that directory; note this does not prevent upload of malicious files but blocks their execution, and must be re-verified after any Joomla or server update that could overwrite .htaccess. As a defense-in-depth measure, deploy a WAF rule to inspect multipart archive uploads for embedded PHP content on the gallery upload endpoint, accepting the trade-off of minor false-positive risk on archives containing non-PHP scripts.