CVE-2026-48946

CVE-2026-48946 affects the K2 Joomla extension (getk2.com) prior to version 2.26. The vulnerability arises because the frontend article-attachment upload path accepts files with a .php extension and Apache mod_php executes them as the K2 web user. An authenticated K2 Author can upload a shell.php...