K2 ≤ 2.26 renders the #k2users.image column directly into HTML src attributes via two distinct templates, in both cases without HTML escaping.

The K2 article gallery upload path accepts a zip/tar archive, extracts it under /media/k2/galleries/<id>/, and only renames image files (gif/jpg/jpeg/png/webp) to safe names — non-image files (including .php) are extracted as-is and remain executable via direct HTTP access.

The K2 frontend article-save handler accepts an attachment[N][existing] POST field that is concatenated with JPATHSITE/ and passed to JFile::copy(). JPath::clean does NOT strip .., and there is no allow-list of source paths. An Author can therefore copy configuration.php (or any other file readable by the web user — including ../../../etc/passwd) into /media/k2/attachments/, then retrieve the contents via the K2 attachment-download endpoint.