CVE-2026-48946: Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26
The K2 frontend article-attachment upload path accepts files whose extension is .php, and Apache's standard modphp matches \.php$ and executes them under the K2 web user. A K2 Author can upload a shell.php, then fetch /media/k2/attachments/shell.php and execute arbitrary PHP code in the web server's context.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48946?
CVE-2026-48946 has a medium severity rating of 6.3 according to the CVSS 3.1 scoring system.
How do I fix CVE-2026-48946?
To fix CVE-2026-48946, ensure you update the K2 extension for Joomla to version 2.26 or later.
What type of vulnerability is CVE-2026-48946?
CVE-2026-48946 is classified as a privilege escalation vulnerability that allows for remote code execution.
Which Joomla extension is affected by CVE-2026-48946?
CVE-2026-48946 affects the K2 extension for Joomla, specifically versions prior to 2.26.
What can attackers do with CVE-2026-48946?
Attackers can exploit CVE-2026-48946 to upload malicious PHP files and execute arbitrary code on the server.