Описание
The K2 article gallery upload path accepts a zip/tar archive, extracts it under /media/k2/galleries/<id>/, and only renames image files (gif/jpg/jpeg/png/webp) to safe names — non-image files (including .php) are extracted as-is and remain executable via direct HTTP access.
Ссылки
- Product
Уязвимые конфигурации
Конфигурация 1Версия до 2.26 (включая)
cpe:2.3:a:joomlaworks:k2:*:*:*:*:*:joomla\!:*:*
EPSS
Процентиль: 10%
0.00197
Низкий
5.3 Medium
CVSS3
Дефекты
CWE-434
Связанные уязвимости
CVSS3: 5.3
github
около 2 месяцев назад
The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, and only renames image files (gif/jpg/jpeg/png/webp) to safe names — non-image files (including `.php`) are extracted as-is and remain executable via direct HTTP access.
EPSS
Процентиль: 10%
0.00197
Низкий
5.3 Medium
CVSS3
Дефекты
CWE-434