CVE-2026-48944
Description
The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH_SITE/` and passed to `JFile::copy()`. `JPath::clean` does NOT strip `..`, and there is no allow-list of source paths. An Author can therefore copy `configuration.php` (or any other file readable by the web user — including `../../../etc/passwd`) into `/media/k2/attachments/`, then retrieve the contents via the K2 attachment-download endpoint.
Summary dbcve.org
K2 component for Joomla contains a path traversal vulnerability in the frontend article-save handler. The `attachment[N][existing]` POST parameter is concatenated with `JPATH_SITE/` and passed to `JFile::copy()` without sanitizing `..` sequences. Since `JPath::clean` does not strip path traversal sequences and no allow-list exists, an authenticated Author can copy sensitive files (like configuration.php or /etc/passwd) to the /media/k2/attachments/ directory and retrieve them via the download endpoint.
Mitigation
Implement path traversal protection by validating that the source path does not contain `..` sequences and/or implementing an allow-list of permitted source paths within the JPATH_SITE boundary before passing to JFile::copy().