← Database

CVE-2026-48942

MEDIUM CVSS: 6.1 Published: 2026-06-25 Modified: 2026-06-28

Description

K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.

Affected Platforms

Joomlaworks K2

Weakness Type

CWE-79

References