CVE-2026-48944

The K2 frontend article-save handler accepts an "attachmentNexisting" POST field that is concatenated with "JPATHSITE/" and passed to "JFile::copy". "JPath::clean" does NOT strip "..", and there is no allow-list of source paths. An Author can therefore copy "configuration.php" or any other file...

CVE-2026-48944: Improper Limitation of a Pathname to a Restricted Directory

The K2 frontend article-save handler accepts an attachmentNexisting POST field that is concatenated with JPATHSITE/ and passed to JFile::copy. JPath::clean does NOT strip .., and there is no allow-list of source paths. An Author can therefore copy configuration.php or any other file readable by t...