CVE-2026-48946 is an unrestricted file upload vulnerability (CWE-434) in the K2 extension for Joomla. The frontend article-attachment upload path does not restrict file extensions, allowing files with .php extensions to be uploaded. Since Apache's mod_php executes files matching ".php", an attacker with K2 Author privileges can upload a PHP web shell and execute arbitrary code in the context of the web server user by accessing the uploaded file. This vulnerability affects versions 1.0 through 2.26 of the K2 extension.

An attacker with K2 Author privileges can upload and execute arbitrary PHP code on the web server, potentially leading to code execution, data compromise, or server takeover. The impact includes loss of confidentiality, integrity, and availability of the affected system. However, exploitation requires authenticated author-level access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict K2 Author privileges to trusted users only and consider disabling or restricting file uploads in the K2 extension. Monitor for suspicious uploaded files and remove any unauthorized .php files from the attachments directory.