File Upload Vulnerability in K2 Article Gallery by K2

CVE-2026-48945

What is CVE-2026-48945?

The K2 Article Gallery has a vulnerability where the upload path for zip/tar archives improperly handles files. It extracts images to a designated directory and renames them securely, but fails to restrict the extraction of non-image files, including executable scripts such as '.php'. This oversight permits these files to be executed via direct HTTP access, creating a significant security risk for users leveraging this gallery functionality.

References