File Inclusion Vulnerability in K2 for Joomla by GetK2

CVE-2026-48944

What is CVE-2026-48944?

A file inclusion vulnerability exists in K2 for Joomla, where the frontend article-save handler improperly handles the attachment[N][existing] POST field. This field is merged with JPATH_SITE/ and subsequently passed to JFile::copy(). Unfortunately, JPath::clean does not adequately strip out directory traversal sequences like .., allowing an attacker with author-level permissions to exploit this weakness. An attacker could leverage this to overwrite sensitive files such as configuration.php or access any file that the web user can read, including critical system files like ../../../etc/passwd. Consequently, this raises significant security concerns for affected installations.

References