https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 21:56:13 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-330913 EUVD-2026-330913 https://cve.radiocsirt.org/vuln/euvd-2026-330913 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48946 <p>The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache&#39;s standard mod_php matches `\.php$` and executes them under the K2 web user. A K2 Author can upload a `shell.php`, then fetch `/media/k2/attachments/shell.php` and execute arbitrary PHP code in the web server&#39;s context.</p> <p>The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache&#39;s standard mod_php matches `\.php$` and executes them under the K2 web user. A K2 Author can upload a `shell.php`, then fetch `/media/k2/attachments/shell.php` and execute arbitrary PHP code in the web server&#39;s context.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48946 https://cve.radiocsirt.org/vuln/ghsa-hmpj-wp8r-7h2p <p>The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache&#39;s standard mod_php matches `\.php$` and executes them under the K2 web user. A K2 Author can upload a `shell.php`, then fetch `/media/k2/attachments/shell.php` and execute arbitrary PHP code in the web server&#39;s context.</p> <p>The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache&#39;s standard mod_php matches `\.php$` and executes them under the K2 web user. A K2 Author can upload a `shell.php`, then fetch `/media/k2/attachments/shell.php` and execute arbitrary PHP code in the web server&#39;s context.</p> https://cve.radiocsirt.org/vuln/ghsa-hmpj-wp8r-7h2p