MEDIUMCVSS 5.3
CVE-2026-48945
CVE-2026-48945 updated by NVD
Summary
The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/ /`, and only renames image files (gif/jpg/jpeg/png/webp) to safe names — non-image files (including `.php`) are extracted as-is and remain executable via direct HTTP access.
References
Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.
CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.