CVE-2026-48945 is a CWE-434 unrestricted file upload vulnerability in the K2 extension for Joomla (versions 1.0 through 2.26). The vulnerability arises because the gallery upload path accepts archive files and extracts them under `/media/k2/galleries/<id>/`. Only image files (gif, jpg, jpeg, png, webp) are renamed to safe filenames, but non-image files, including `.php` scripts, are extracted as-is. These files remain executable and accessible via direct HTTP access, enabling potential remote code execution or other malicious actions.

An attacker can upload a crafted archive containing malicious non-image files such as PHP scripts. Since these files are extracted without renaming or sanitization and remain executable, the attacker could execute arbitrary code on the web server. This compromises the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or restrict the gallery upload feature to trusted users only and implement additional server-side controls to prevent execution of uploaded files in the `/media/k2/galleries/` directory (e.g., web server configuration to disallow PHP execution).