Executive brief
K2 is a popular content management extension for Joomla websites. A security flaw in how it handles article attachments allows users with 'Author' permissions to access sensitive files on the server that they should not be able to see. This could lead to the exposure of website configuration files or system passwords, potentially allowing an attacker to gain further control over the site or server.
Technical details
A path traversal vulnerability exists in the K2 frontend article-save handler due to improper validation of the `attachment[N][existing]` POST field. This field is concatenated with `JPATH_SITE/` and passed to `JFile::copy()` without sufficient sanitization, as `JPath::clean` fails to strip '..' sequences. An attacker with Author-level privileges can exploit this to copy arbitrary files readable by the web user (such as `configuration.php` or `/etc/passwd`) into the public `/media/k2/attachments/` directory. Once copied, the files can be retrieved via the standard K2 attachment-download endpoint.
Affected products
- getk2.com K2 extension for Joomla 1.0-2.26
Timeline
- 2026-06-25: advisory: Vulnerability published by the Joomla! Project