CVE-2026-48940

A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<script>` tag; K2 stores it verbatim and renders it unescaped to any visitor of the article page.

CVSS v3 3.4 LOW

3.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.7 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.getk2.org/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:joomlaworks:k2:*:*:*:*:*:joomla\!:*:*

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Un usuario de Joomla con derechos de ’crear elemento’ de K2 (nivel de Autor por defecto) puede enviar un artículo cuyo campo POST ’embedVideo’ contiene una etiqueta ’[script_tag]’ en bruto; K2 lo almacena textualmente y lo renderiza sin escapar a cualquier visitante de la página del artículo.

Information

Published : 2026-06-25 16:16

Updated : 2026-10-25 22:10

NVD link : CVE-2026-48940

Mitre link : CVE-2026-48940

CVE.ORG link : CVE-2026-48940

JSON object : View

Products Affected

joomlaworks

k2

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-48940", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48940", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T18:47:21.595982Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.4, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.7}]}, "affected": [{"source": "security@joomla.org", "affectedData": [{"vendor": "getk2.org", "product": "K2 extension for Joomla", "versions": [{"status": "affected", "version": "1.0-2.26"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-25T16:16:36.410", "references": [{"url": "https://www.getk2.org/", "tags": ["Product"], "source": "security@joomla.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@joomla.org", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A Joomla user with K2 \"create item\" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<script>` tag; K2 stores it verbatim and renders it unescaped to any visitor of the article page."}, {"lang": "es", "value": "Un usuario de Joomla con derechos de \u2019crear elemento\u2019 de K2 (nivel de Autor por defecto) puede enviar un art\u00edculo cuyo campo POST \u2019embedVideo\u2019 contiene una etiqueta \u2019[script_tag]\u2019 en bruto; K2 lo almacena textualmente y lo renderiza sin escapar a cualquier visitante de la p\u00e1gina del art\u00edculo."}], "lastModified": "2026-10-25T22:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:joomlaworks:k2:*:*:*:*:*:joomla\\!:*:*", "vulnerable": true, "matchCriteriaId": "75F0068E-23F6-4BDC-97E2-AAD0D06F5D72", "versionEndIncluding": "2.26"}], "operator": "OR"}]}], "sourceIdentifier": "security@joomla.org"}