CVE-2026-48944: Joomla Extension - getk2.org - Exposure of sensitive files via attachment copy in K2 extension for Joomla < 2.26
The K2 frontend article-save handler accepts an attachment[N][existing] POST field that is concatenated with JPATHSITE/ and passed to JFile::copy(). JPath::clean does NOT strip .., and there is no allow-list of source paths. An Author can therefore copy configuration.php (or any other file readable by the web user — including ../../../etc/passwd) into /media/k2/attachments/, then retrieve the contents via the K2 attachment-download endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
K2 extension for Joomla (getk2.org)to a version that resolves this vulnerability.Fixed in 2.26Patch Exposure of sensitive files via attachment copy in K2 extension for Joomla < 2.26 - Configuration
Update/patch the K2 extension so the attachment existing path passed to JFile::copy() cannot be manipulated via ../ traversal because JPath::clean does NOT strip .. and there is no allow-list of source paths.
K2 Joomla extension (attachment handling) attachment[N][existing] path allow-list/normalization = Prevent traversal (reject values containing ../ or other path traversal sequences) and ensure JPATH_SITE concatenation cannot escape web root
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48944?
CVE-2026-48944 has a medium severity rating of 6.5 based on the CVSS 3.1 scoring.
How do I fix CVE-2026-48944?
To fix CVE-2026-48944, you should update the K2 extension for Joomla to version 2.26 or later.
What type of vulnerability is CVE-2026-48944?
CVE-2026-48944 is a Path Traversal vulnerability that allows unauthorized access to sensitive files.
What consequences can arise from CVE-2026-48944?
Exploitation of CVE-2026-48944 can lead to exposure of sensitive files, including configuration files.
Which software is affected by CVE-2026-48944?
CVE-2026-48944 affects the K2 extension for Joomla, specifically versions prior to 2.26.