https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-13T16:40:06.652492+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-48945 fkie_cve-2026-48945 2026-11-13T16:40:06.653702+00:00

The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, and only renames image files (gif/jpg/jpeg/png/webp) to safe names — non-image files (including `.php`) are extracted as-is and remain executable via direct HTTP access.

 https://db.gcve.eu/vuln/ghsa-6mmg-h49f-fj9x GHSA-6mmg-h49f-fj9x 2026-11-13T16:40:06.653757+00:00

The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, and only renames image files (gif/jpg/jpeg/png/webp) to safe names — non-image files (including `.php`) are extracted as-is and remain executable via direct HTTP access.