Unauthenticated File Deletion in K2 Media Management by Joomla!

CVE-2026-48941

What is CVE-2026-48941?

The K2 media management system for Joomla! is susceptible to a vulnerability in the frontend item.checkin task, which allows unauthenticated users to pass a specially crafted sigProFolder query parameter. This can result in unauthorized access to the JFolder::delete() function, leading to potential file deletion within the /media/k2/galleries/ directory. It underscores the necessity of implementing strict validation on user input to safeguard against such exploitation.

References