CVE-2026-48945 describes an unrestricted file upload vulnerability (CWE-434) in the K2 extension for Joomla. The extension's article gallery upload path accepts zip or tar archives and extracts their contents under `/media/k2/galleries/<id>/`. Only image files (gif, jpg, jpeg, png, webp) are renamed to safe filenames, but non-image files, including PHP scripts, are extracted without renaming or sanitization. These files remain executable and accessible via direct HTTP access, potentially allowing an attacker to upload and execute arbitrary code on the server. The affected versions are from 1.0 up to 2.26. No official patch or remediation guidance is currently available from the vendor.

An attacker can upload archives containing malicious non-image files (e.g., PHP scripts) that are extracted and remain executable on the server. This could allow unauthorized code execution or other malicious actions via direct HTTP access to the uploaded files. The CVSS score of 5.3 reflects a medium impact primarily on confidentiality, with no direct impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable archive uploads in the K2 article gallery upload feature if possible. Monitor and control file upload permissions and web server execution rights in the `/media/k2/galleries/` directory to prevent execution of unauthorized files.