# CVE-2026-48944: Joomla K2 path traversal in article-save handler

Source: https://junglewise.ai/threats/cve-2026-48944-joomla-k2-path-traversal-in-article-save-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-48944 · Severity: info · CVSS 0 · Published 2026-06-25

K2 is a popular content management extension for Joomla websites. A security flaw in how it handles article attachments allows users with 'Author' permissions to access sensitive files on the server that they should not be able to see. This could lead to the exposure of website configuration files or system passwords, potentially allowing an attacker to gain further control over the site or server.

Technologies: [JoomlaWorks K2](https://junglewise.ai/threats/technologies/k2). Vendors: [JoomlaWorks](https://junglewise.ai/threats/vendors/joomlaworks).

## Quick answers

**Is CVE-2026-48944 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48944 being exploited in the wild.

**How severe is CVE-2026-48944?** Informational severity, with a CVSS score of 0, published 25 June 2026.

**Which products and versions are affected?** JoomlaWorks K2 1.0-2.26.

**Is there a fix for CVE-2026-48944?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48944 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48944?** Check whether you run JoomlaWorks K2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the K2 frontend article-save handler due to improper validation of the `attachment[N][existing]` POST field. This field is concatenated with `JPATH_SITE/` and passed to `JFile::copy()` without sufficient sanitization, as `JPath::clean` fails to strip '..' sequences. An attacker with Author-level privileges can exploit this to copy arbitrary files readable by the web user (such as `configuration.php` or `/etc/passwd`) into the public `/media/k2/attachments/` directory. Once copied, the files can be retrieved via the standard K2 attachment-download endpoint.

## Affected products

- getk2.com K2 extension for Joomla 1.0-2.26

## Timeline

- 2026-06-25: advisory: Vulnerability published by the Joomla! Project

## References

- [https://www.getk2.org/](https://www.getk2.org/)

## Related threats

- [Joomla K2 Extension Unrestricted File Upload in Article Attachments](https://junglewise.ai/threats/cve-2026-48946-joomla-k2-extension-unrestricted-file-upload-in-article)
- [Joomla K2 extension unrestricted file upload in article gallery upload](https://junglewise.ai/threats/cve-2026-48945-joomla-k2-extension-unrestricted-file-upload-in-article-gallery)
- [JoomlaWorks K2 mass-assignment in plg_user_k2 plugin](https://junglewise.ai/threats/cve-2026-48943-joomlaworks-k2-mass-assignment-in-plg-user-k2-plugin)
- [Joomla K2 Extension Cross-Site Scripting in User Images](https://junglewise.ai/threats/cve-2026-48942-joomla-k2-extension-cross-site-scripting-in-user-images)
- [Joomla K2 extension unauthorized folder deletion in item.checkin task](https://junglewise.ai/threats/cve-2026-48941-joomla-k2-extension-unauthorized-folder-deletion-in-item-checkin)