CVE-2026-48944

The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH_SITE/` and passed to `JFile::copy()`. `JPath::clean` does NOT strip `..`, and there is no allow-list of source paths. An Author can therefore copy `configuration.php` (or any other file readable by the web user — including `../../../etc/passwd`) into `/media/k2/attachments/`, then retrieve the contents via the K2 attachment-download endpoint.

• CWE-22

• https://www.getk2.org/Product

Published

Jun 25, 2026

Last Modified

Jun 28, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48937A flaw in Node.js HTTP/2 server API can cause servers to kee…5.3
• CVE-2026-48939A vulnerability in the iCagenda extension for Joomla allows …9.8
• CVE-2026-48940A Joomla user with K2 "create item" rights (Author tier by d…3.4
• CVE-2026-48941The K2 frontend `item.checkin` task accepts an unauthenticat…6.5
• CVE-2026-48942K2 ≤ 2.26 renders the `#__k2_users.image` column directly in…6.1
• CVE-2026-48943K2 ≤ 2.24 contains a mass-assignment defect in the K2 system…6.5
• CVE-2026-48945The K2 article gallery upload path accepts a zip/tar archive…5.3
• CVE-2026-48946The K2 frontend article-attachment upload path accepts files…6.3
• CVE-2026-48947An improper access check allows privileged users to overwrit…4.9
• CVE-2026-48948An improper access check allows user to download vcard expor…8.8
• CVE-2026-48949Lack of validation leads to an XSS vulnerability in the MFA …6.1
• CVE-2026-4895The GreenShift - Animation and Page Builder Blocks plugin fo…6.4