File Upload Vulnerability in K2 by Joomla

CVE-2026-48946

What is CVE-2026-48946?

The K2 component for Joomla is susceptible to a significant security flaw that permits malicious users to upload PHP files through the article-attachment path. Specifically, the system improperly handles files with a .php extension, allowing unauthorized authors to upload potentially harmful scripts, such as shell.php. Once uploaded, these scripts can be executed in the context of the K2 web user, leading to arbitrary code execution on the server. This vulnerability underscores the need for stringent validation measures on file uploads to prevent exploitation.

References