K2 vulnerabilities

A vulnerability in the K2 component allows authors to upload PHP files as article attachments. Apache executes these files, enabling remote PHP code execution in the web server context.

A vulnerability in the K2 component for Joomla! allows uploading a ZIP/TAR archive containing PHP files to the gallery directory. The system only renames image files, leaving non-image files (including PHP) extracted as-is and accessible via HTTP, enabling remote code execution.

A vulnerability in the K2 component for Joomla! allows an Author to copy any file readable by the web user (e.g., configuration.php or /etc/passwd) to the /media/k2/attachments/ directory by manipulating the `attachment[N][existing]` POST field. Lack of source path validation and `..` filtering in `JPath::clean` enables a path traversal attack.

A mass-assignment vulnerability in K2 ≤ 2.24 exists in the `plg_user_k2` system user plugin. A registered Joomla user can, by including the `K2UserForm=1` field in a standard `com_users` `profile.save` POST request, write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `#__k2_users` table, which are not exposed by the K2 frontend profile-edit form.

K2 version 2.26 and earlier renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.

A vulnerability in the K2 component for Joomla! allows an unauthenticated attacker to delete arbitrary directories via the `sigProFolder` parameter in the `item.checkin` task. The attacker can exploit this flaw to remove gallery directories under `/media/k2/galleries/`.

A Joomla user with K2 'create item' rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<script>` tag; K2 stores it verbatim and renders it unescaped to any visitor of the article page.