CVE-2026-48941 — Joomla Extension - getk2.org - Unauthenticated folder delete in K2 extension for Joomla < 2.26
The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::delete()` call under `/media/k2/galleri…
Published: 2026-06-25 · CVSS: 6.5 · CVSS 3.1
The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::delete()` call under `/media/k2/galleries/`
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7