PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48940 Joomlaworks CVE debrief

A Joomla user with K2 'create item' rights, typically at the Author tier, can submit an article with a raw <script> tag in the embedVideo POST field. The K2 extension stores this input verbatim and renders it unescaped on the article page, potentially leading to malicious script execution. This vulnerability has a CVSS score of 3.4 and is considered low severity. The issue was published on June 25, 2026, and last modified on June 28, 2026. Users with 'create item' rights should be cautious when creating content, and administrators should ensure that user roles are properly configured to prevent exploitation.

Vendor
Joomlaworks
Product
K2
CVSS
LOW 3.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-25
Original CVE updated
2026-06-28
Advisory published
2026-06-25
Advisory updated
2026-06-28

Who should care

Joomla users with K2 'create item' rights, administrators of Joomla sites using the K2 extension, and security teams monitoring for potential script injection attacks should be aware of this vulnerability. Although the CVSS score is low, the potential for script injection makes it important for those with relevant roles to take note and assess their exposure.

Technical summary

The vulnerability exists in the K2 extension for Joomla, specifically in how it handles user input in the embedVideo POST field. Users with 'create item' rights can inject raw <script> tags, which are stored and rendered unescaped on the article page. This could potentially allow for malicious script execution. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N, indicating a high level of complexity for exploitation but potential for confidentiality impact.

Defensive priority

Given the low CVSS score and the requirement for user interaction, the defensive priority is moderate. However, administrators should still take steps to mitigate the risk, especially if users with 'create item' rights are not trusted or if the site allows public submissions.

Recommended defensive actions

  • Review and restrict user roles with 'create item' rights in the K2 extension.
  • Implement additional input validation and sanitization for the embedVideo field.
  • Monitor article submissions for suspicious activity.
  • Consider upgrading to a version of K2 that may include a fix for this issue, if available.
  • Educate users with 'create item' rights about the risks of script injection and the importance of proper content creation practices.

Evidence notes

The CVE record and NVD detail provide official information about the vulnerability. The source item URL offers additional context from the NVD database. The reference to https://www.getk2.org/ may provide further information about the K2 extension and potential mitigations.

Official resources

This article was generated with AI assistance based on the supplied source corpus and is intended for informational purposes only.