CVSS base score
What the vulnerability does
The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, and only renames image files (gif/jpg/jpeg/png/webp) to safe names — non-image files (including `.php`) are extracted as-is and remain executable via direct HTTP access.
Explanation of Vulnerability in Simple Terms
The K2 extension for Joomla contains an unrestricted file upload vulnerability. An attacker can upload files to the server without proper validation, potentially allowing them to store malicious files or execute code. The exact attack requirements and impact severity cannot be determined due to missing CVSS data. Site administrators should update to a patched version when available.
What an attacker can do
Upload files to the server without proper validation or restrictions.
Potential impact on your site
Attackers may upload malicious files that could compromise site security or enable code execution.
Conditions required to exploit
Access to the K2 extension's upload functionality; specific authentication requirements unknown.
Key dates
External resources
Related vulnerabilities
