and executes them under t","inLanguage":"en","isPartOf":{"@id":"https://saibaradar.com/#website"},"publisher":{"@id":"https://saibaradar.com/#publisher"},"mainEntity":{"@id":"https://saibaradar.com/vulnerabilities/CVE-2026-48946?lang=en#article"},"breadcrumb":{"@id":"https://saibaradar.com/vulnerabilities/CVE-2026-48946?lang=en#breadcrumb"}},{"@type":"Article","@id":"https://saibaradar.com/vulnerabilities/CVE-2026-48946?lang=en#article","headline":"CVE-2026-48946 — Vulnerability intelligence","description":"CVE-2026-48946: k2. The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php matches `\\.php CVE-2026-48946 — Vulnerability intelligence | SaibaRadar and executes them under t","mainEntityOfPage":{"@id":"https://saibaradar.com/vulnerabilities/CVE-2026-48946?lang=en#webpage"},"author":{"@id":"https://saibaradar.com/#publisher"},"publisher":{"@id":"https://saibaradar.com/#publisher"},"inLanguage":"en","image":"https://saibaradar.com/social/saibaradar-share-v1.jpg","citation":[{"@type":"CreativeWork","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48946","name":"CVE-2026-48946"},{"@type":"CreativeWork","url":"https://www.getk2.org/","name":"Product"},{"@type":"CreativeWork","url":"https://www.cve.org/CVERecord?id=CVE-2026-48946","name":"CVE-2026-48946"}],"isBasedOn":["https://nvd.nist.gov/vuln/detail/CVE-2026-48946","https://www.getk2.org/","https://www.cve.org/CVERecord?id=CVE-2026-48946"],"datePublished":"2026-06-25T15:25:28.947Z","dateModified":"2026-11-04T15:49:48.387Z"},{"@type":"BreadcrumbList","@id":"https://saibaradar.com/vulnerabilities/CVE-2026-48946?lang=en#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"SaibaRadar","item":"https://saibaradar.com/?lang=en"},{"@type":"ListItem","position":2,"name":"CVE-2026-48946 — Vulnerability intelligence","item":"https://saibaradar.com/vulnerabilities/CVE-2026-48946?lang=en"}]}]}
SaibaRadar

CVE-2026-48946 — Vulnerability intelligence

joomlaworks — k2

Published:

CVSS
6.3
CISA KEV
Not listed; not proof of no exploitation

Original source text (not a translation)

The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php matches `\.php CVE-2026-48946 — Vulnerability intelligence | SaibaRadar
SaibaRadar
and executes them under the K2 web user. A K2 Author can upload a `shell.php`, then fetch `/media/k2/attachments/shell.php` and execute arbitrary PHP code in the web server's context.

Sources