The K2 frontend article-save handler in versions 1.0 to 2.26 accepts an `attachment[N][existing]` POST parameter that is concatenated with the Joomla root path (`JPATH_SITE/`) and passed to `JFile::copy()`. The path cleaning function `JPath::clean` does not remove directory traversal sequences (`..`), and there is no allow-list restricting source paths. Consequently, an authenticated Author can copy any file readable by the web user, including sensitive files like `configuration.php` or `/etc/passwd`, into the `/media/k2/attachments/` directory. These files can then be accessed via the K2 attachment-download endpoint, leading to unauthorized disclosure of sensitive information.

An authenticated user with Author privileges can exploit this vulnerability to read arbitrary files on the server that are accessible by the web user. This can lead to disclosure of sensitive configuration files or system files, potentially exposing credentials or system information. The vulnerability does not allow modification or deletion of files, nor does it impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and monitor for suspicious activity related to attachment uploads and downloads. Avoid exposing sensitive files via the web server and consider disabling the K2 attachment-download feature if not required.