The K2 frontend article-save handler accepts an `attachment[N][existing]` POST parameter that is concatenated with the Joomla base path `JPATH_SITE/` and passed to `JFile::copy()`. The path cleaning function `JPath::clean` does not remove `..` sequences, and there is no allow-list restricting source file paths. Consequently, an authenticated Author can exploit this to copy arbitrary readable files from the server filesystem into `/media/k2/attachments/`. These files can then be downloaded through the K2 attachment-download endpoint, leading to unauthorized file disclosure. The affected versions are K2 extension for Joomla from 1.0 up to and including 2.26. No official patch or remediation guidance is currently available.

An authenticated user with Author privileges can read arbitrary files on the server that are accessible to the web user by copying them into a publicly accessible directory and then downloading them. This can lead to disclosure of sensitive information such as configuration files or system files, potentially compromising the confidentiality of the Joomla installation and the underlying server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and consider disabling or restricting the K2 attachment functionality to prevent exploitation. Monitor for updates from the vendor regarding an official fix.