What is the CVSS score of CVE-2026-48944?

CVE-2026-48944 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

K2 for Joomla CVE-2026-48944

EUVD-2026-39440 MEDIUM

Path Traversal (CWE-22)

2026-06-25 Joomla

GHSA-858x-6wp8-wp5c

Path Traversal PHP K2 Extension For Joomla

6.5

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

PR:L reflects mandatory Author-level authentication; C:H because arbitrary web-readable files including database credentials are exfiltrated; no integrity or availability impact occurs.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 19:23 vuln.today

CVSS changed

Jun 25, 2026 - 19:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 25, 2026 - 15:24 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The K2 frontend article-save handler accepts an attachment[N][existing] POST field that is concatenated with JPATH_SITE/ and passed to JFile::copy(). JPath::clean does NOT strip .., and there is no allow-list of source paths. An Author can therefore copy configuration.php (or any other file readable by the web user - including ../../../etc/passwd) into /media/k2/attachments/, then retrieve the contents via the K2 attachment-download endpoint.

AnalysisAI

Path traversal in the K2 extension for Joomla (versions 1.0-2.26) allows authenticated Authors to copy arbitrary web-readable files - including Joomla's database credential file configuration.php and OS files such as /etc/passwd - into a publicly accessible directory for retrieval. The article-save handler's attachment[N][existing] POST parameter is concatenated with JPATH_SITE/ and passed directly to JFile::copy() without stripping ../ sequences or enforcing a source-path allow-list, making traversal trivial. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain or register Joomla Author credentials

Delivery

Craft article-save POST with path traversal in attachment[N][existing]

Exploit

JFile::copy() copies target file to /media/k2/attachments/

Execution

Retrieve staged file via K2 download endpoint

Impact

Extract database credentials and Joomla secret key

Access

Obtain or register Joomla Author credentials

Delivery

Craft article-save POST with path traversal in attachment[N][existing]

Exploit

JFile::copy() copies target file to /media/k2/attachments/

Execution

Retrieve staged file via K2 download endpoint

Impact

Extract database credentials and Joomla secret key

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid Joomla Author-level account (or higher role) on the target site - this is the primary and most significant limiting factor. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) is consistent with an independent assessment: network-delivered, low complexity, requiring only Author-level credentials, with high confidentiality impact and no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated Joomla Author submits a crafted article-save POST request with the field `attachment[0][existing]` set to a value such as `../../configuration.php`, causing `JFile::copy()` to replicate the Joomla database configuration file into `/media/k2/attachments/configuration.php`. The attacker then issues a second HTTP request to the K2 attachment-download endpoint to retrieve the staged file, obtaining the database hostname, credentials, and Joomla secret key. …
Remediation	Consult the vendor advisory at https://www.getk2.org/ and apply any K2 release beyond 2.26 that addresses the path traversal in the article-save handler - no confirmed patch version is available in the current intelligence data, so monitor the vendor channel actively. … Detailed patch versions, workarounds, and compensating controls in full report.