CVE-2026-48946 Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26
A K2 Author can upload a PHP shell via the attachment feature to execute arbitrary code on the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48946?
CVE-2026-48946 is a medium-severity vulnerability in getk2.org K2 extension for Joomla, published on 25 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php matches `\.php$` and executes them under the K2 web user. A K2 Author can upload a `shell.php`, then fetch `/media/k2/attachments/shell.php` and execute arbitrary PHP code in the web server's context.
Weakness: CWE-434
Which versions are affected by CVE-2026-48946?
It affects 1 product.
Products include Joomlaworks K2.
How do I fix CVE-2026-48946?
No fix has been published for CVE-2026-48946 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-48946 being exploited?
There is no known exploitation of CVE-2026-48946 in the wild and no public exploit code.
Other vulnerabilities in getk2.org K2 extension for Joomla
- CVE-2019-19634 class.upload.php in verot.net omits .pht from the set of dangerous file extensions
- CVE-2019-19576 Remote code execution in verot/class.upload.php
- CVE-2018-7482 Path traversal in n/a
- CVE-2026-48941 Joomla Extension - getk2.org - Unauthenticated folder delete in K2 extension for Joomla < 2.26
- CVE-2026-48943 Joomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla < 2.26
Sources
Also known as GHSA-hmpj-wp8r-7h2p.