CVE-2026-48944

The K2 frontend article-save handler accepts an "attachmentNexisting" POST field that is concatenated with "JPATHSITE/" and passed to "JFile::copy". "JPath::clean" does NOT strip "..", and there is no allow-list of source paths. An Author can therefore copy "configuration.php" or any other file...