CVE-2026-48946

Name of the Vulnerable Software and Affected Versions K2 (affected versions not specified)

Description The frontend article-attachment upload path allows the upload of files with the .php extension. When used with Apache's standard mod php, which matches the .php$ pattern, these files are executed under the K2 web user. This allows a user with K2 Author privileges to upload a malicious file, such as shell.php, and access it via the endpoint /media/k2/attachments/shell.php to execute arbitrary PHP code within the context of the web server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.