What the vulnerability does
01Description
The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH_SITE/` and passed to `JFile::copy()`. `JPath::clean` does NOT strip `..`, and there is no allow-list of source paths. An Author can therefore copy `configuration.php` (or any other file readable by the web user — including `../../../etc/passwd`) into `/media/k2/attachments/`, then retrieve the contents via the K2 attachment-download endpoint.
Explanation of Vulnerability in Simple Terms
02Summary
The K2 extension for Joomla contains a path traversal vulnerability that allows an attacker to access files outside the intended directory. By manipulating file paths in requests, an attacker can read sensitive files on the server. The exact attack requirements and impact scope cannot be fully determined due to incomplete CVSS data.
What an attacker can do
03Attacker Capabilities
Read files outside the intended K2 directory on the server.
Potential impact on your site
04Site Impact
Sensitive files (config, database credentials, private data) may be exposed to attackers.
Conditions required to exploit
05Prerequisites
Network access to the Joomla site; specific attack vector details unavailable.
Key dates
06Disclosure timeline
June 25, 2026
CVE published
June 28, 2026
Record updated
