What is the CVSS score of CVE-2026-48944?

CVE-2026-48944 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

K2 for Joomla CVE-2026-48944

EUVD-2026-39440 MEDIUM

Path Traversal (CWE-22)

2026-06-25 Joomla

GHSA-858x-6wp8-wp5c

PHP Path Traversal K2 Extension For Joomla Getk2 Com

6.5

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

PR:L reflects mandatory Author-level authentication; C:H because arbitrary web-readable files including database credentials are exfiltrated; no integrity or availability impact occurs.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 19:23 vuln.today

CVSS changed

Jun 25, 2026 - 19:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 25, 2026 - 15:24 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The K2 frontend article-save handler accepts an attachment[N][existing] POST field that is concatenated with JPATH_SITE/ and passed to JFile::copy(). JPath::clean does NOT strip .., and there is no allow-list of source paths. An Author can therefore copy configuration.php (or any other file readable by the web user - including ../../../etc/passwd) into /media/k2/attachments/, then retrieve the contents via the K2 attachment-download endpoint.

AnalysisAI

Path traversal in the K2 extension for Joomla (versions 1.0-2.26) allows authenticated Authors to copy arbitrary web-readable files - including Joomla's database credential file configuration.php and OS files such as /etc/passwd - into a publicly accessible directory for retrieval. The article-save handler's attachment[N][existing] POST parameter is concatenated with JPATH_SITE/ and passed directly to JFile::copy() without stripping ../ sequences or enforcing a source-path allow-list, making traversal trivial. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the confidentiality impact is severe on multi-author Joomla sites where Author accounts may be widely distributed.

Technical ContextAI

K2 is a PHP-based content management extension for the Joomla CMS, distributed by getk2.com (CPE: cpe:2.3:a:getk2.com:k2_extension_for_joomla:*:*:*:*:*:*:*:*). The flaw resides in the frontend article-save handler, which processes a POST field named attachment[N][existing] representing the path of an existing attachment file. This value is prefixed with JPATH_SITE/ - the Joomla webroot constant - and supplied directly to Joomla's JFile::copy() function. Although JPath::clean() is available in the Joomla framework for path normalization, it does not strip ../ traversal sequences, and the handler applies no allow-list restricting source paths to a safe subdirectory. This is a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) flaw: user-controlled input traverses outside the intended directory tree. The copied file lands in /media/k2/attachments/, a web-accessible location, from which it can be retrieved via K2's attachment-download endpoint.

RemediationAI

Consult the vendor advisory at https://www.getk2.org/ and apply any K2 release beyond 2.26 that addresses the path traversal in the article-save handler - no confirmed patch version is available in the current intelligence data, so monitor the vendor channel actively. As an immediate compensating control, disable frontend article submission in K2's component settings or via Joomla's global configuration, which removes the vulnerable POST endpoint from the attack surface entirely; note this will prevent Authors from submitting articles via the frontend. Restrict the Joomla Author role to fully trusted users and audit existing Author accounts for unnecessary grants. Enforce PHP open_basedir restrictions scoped to the Joomla webroot to prevent JFile::copy() from reading files outside the intended directory tree - test this in staging first, as it may affect legitimate K2 attachment handling. Additionally, consider relocating configuration.php outside JPATH_SITE using Joomla's defines override, which prevents the PHP process from copying it even if the traversal is triggered.