CVE-2026-48944 PUBLISHED

Joomla Extension - getk2.com - Exposure of sensitive files via attachment copy in K2 extension for Joomla < 2.26

Assigner: Joomla
Reserved: 26.05.2026 Published: 25.06.2026 Updated: 25.06.2026

The K2 frontend article-save handler accepts an attachment[N][existing] POST field that is concatenated with JPATH_SITE/ and passed to JFile::copy(). JPath::clean does NOT strip .., and there is no allow-list of source paths. An Author can therefore copy configuration.php (or any other file readable by the web user — including ../../../etc/passwd) into /media/k2/attachments/, then retrieve the contents via the K2 attachment-download endpoint.

Product Status

Vendor getk2.com
Product K2 extension for Joomla
Versions Default: unaffected
  • Version 1.0-2.26 is affected

Credits

  • Matan Bahar finder

References

Problem Types

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory CWE