Fabrik CVE-2026-67282

The specific prerequisite is that the target Joomla site runs Fabrik before 4.6.8 with a frontend Fabrik list/filter reachable by unauthenticated visitors - the vulnerable code path is the frontend 'listfilter' model, so the site must expose a Fabrik list that processes filter input from the public frontend. Given the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N), there are no authentication, user-interaction, or special-configuration barriers beyond having Fabrik installed and its list/filter feature publicly accessible. The main limiting factor is exposure: sites that do not publish Fabrik lists to anonymous users, or that gate them behind authentication or network restrictions, materially reduce reachability of the vulnerable endpoint.

Every available signal points to critical, actionable risk: the CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with high impact to confidentiality, integrity, and availability of both the vulnerable and subsequent systems, yielding a base score of 10.0 - the maximum. Because exploitation requires no authentication, no user interaction, low attack complexity, and a network path against a publicly reachable frontend feature, even a mid-sized municipal IT team in walbrzych should treat any internet-facing Joomla site running Fabrik as urgent. The main tempering factors are that no public proof-of-concept has been identified yet and the CVE is not in CISA KEV, so there is no confirmation of active exploitation - but absence of a published exploit is weak comfort for a trivially exploitable unauthenticated RCE in a CMS extension, a class routinely weaponized shortly after disclosure. EPSS and SSVC data were not provided in the input, so probabilistic exploitation scoring cannot be cross-referenced here; the CVSS-based prioritization stands on its own and should be treated as high priority regardless.

An attacker locates an internet-facing Joomla site running a vulnerable Fabrik version and sends a crafted HTTP request to a public Fabrik list, embedding malicious code in the listfilter parameters. Because the listfilter model evaluates the attacker-controlled input, the payload executes in the PHP process, giving the attacker code execution to drop a web shell, exfiltrate the Joomla database, or pivot deeper. No credentials or user interaction are required, and no public POC is currently known, so the attacker would need to craft the payload independently.