{"affected":[{"defaultStatus":"unaffected","product":"K2 extension for Joomla","source":"CNA: Joomla","vendor":"getk2.org","versions":[{"status":"affected","version":"1.0-2.26"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:joomlaworks:k2:*:*:*:*:*:joomla\\!:*:*","versionEndIncluding":"2.26","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-48946","cwes":["CWE-434"],"description":"The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php matches `\\.php$` and executes them under the K2 web user. A K2 Author can upload a `shell.php`, then fetch `/media/k2/attachments/shell.php` and execute arbitrary PHP code in the web server's context.","epss":{"date":"2026-11-05","percentile":0.20991,"score":0.00284},"exploits":[],"kev":null,"metrics":[{"score":6.3,"severity":"medium","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},{"score":6.3,"severity":"medium","source":"NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"}],"modifiedAt":1793901552930,"publishedAt":1782401128947,"references":[{"source":"CNA: Joomla","tags":["product"],"url":"https://www.getk2.org/"},{"source":"security@joomla.org","tags":["Product"],"url":"https://www.getk2.org/"}],"remediation":[],"revision":"31d9c960868f8d0280cafc9ecf3920f4da58a91ad27428532731aa78df8fb78e","sources":[{"modifiedAt":1793901552930,"name":"CNA: Joomla","retrievedAt":1793902258472,"url":"https://www.cve.org/CVERecord?id=CVE-2026-48946"},{"modifiedAt":1793747865547,"name":"NVD","retrievedAt":1793751391176,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48946"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793902262546,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48946"}],"ssvc":{"assessedAt":1782446155900,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26","updatedAt":1793902262546}