Executive Summary

The vulnerability exists in the K2 article gallery upload path, which accepts zip or tar archives and extracts their contents under the directory /media/k2/galleries/<id>/.

While image files (gif, jpg, jpeg, png, webp) are renamed to safe names during extraction, non-image files, including potentially dangerous files like .php scripts, are extracted without renaming and remain executable.

This means that an attacker can upload a malicious archive containing executable files that will be accessible and executable via direct HTTP access on the server.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to upload and execute arbitrary code on the affected server by placing executable files such as PHP scripts in the gallery upload directory.

As a result, the attacker could potentially take control of the server, access sensitive data, modify or delete content, or use the server as a foothold for further attacks.

Useful 0 Not Useful 0