file: administrator/components/com_k2/model/item.php
Before:

$file = $savepath.DS.$attachment->filename;

After: 

$file = $attachment->filename;
if (strpos($file, JPATH_ROOT) !== 0) {
    $file = $savepath.DS.$attachment->filename;
}