CVE-2026-67282 CRITICAL CVSS 10.0 Fabrik Extension For Joomla Verified Advisory

Unauthenticated remote code execution in Fabrik Joomla extension (CVE-2026-67282)

RCE Code Injection Fabrik Extension For Joomla Fabrikar Com

An unauthenticated attacker can execute arbitrary code on systems running the Fabrik Joomla extension by exploiting the frontend listfilter model. This vulnerability requires no authentication, allowing any remote attacker to fully compromise the affected system. Affected versions: - Fabrik < 4.6.8 We recommend updating to: 4.6.8. CVSS 10.0 · our assessment: act_now Reference: https://www.fabrikar.com/ Details: https://vuln.today/cve/CVE-2026-67282

Verified by vuln.today against published advisories.

Affected versions

– Fabrik < 4.6.8

Fixed in: 4.6.8

Full CVE analysis Reference Published Aug 12, 2026

← All verified advisories