Fabrik Extension CVE-2026-76597

Exploitation requires the target Joomla site to have the Fabrik extension (versions 1.0.0 through 4.7.1) installed and the list email plugin enabled and accessible. The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms no authentication, no user interaction, and no special server-side attack prerequisites are needed - any HTTP client that can reach the plugin's upload endpoint can exploit this flaw. The critical limiting factor stated in the CVE description is that only non-executable files can be uploaded; direct PHP webshell deployment via this path is not confirmed without additional server misconfiguration that enables execution of the uploaded file type in the web root. Sites that have not installed Fabrik, or that have the list email plugin disabled, are not affected.

The CVSS 4.0 score of 8.7 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N accurately reflects the zero-barrier network attack surface and high integrity impact on the vulnerable system. The most significant limiting factor noted in the CVE description is that only 'non-executable files' can be uploaded, meaning direct PHP webshell deployment is not confirmed as the default exploitation path - this distinguishes the flaw from a straightforward remote code execution. On a properly hardened Joomla deployment with execution restrictions on upload directories (e.g., deny PHP in media/upload paths), real-world impact is bounded to content injection, defacement, or phishing asset delivery. On misconfigured servers that permit PHP or script execution in web-writable directories, severity escalates toward full compromise. No EPSS score was provided in the available data, so exploitation probability cannot be quantified. No KEV listing and no POC have been identified, meaning automated widespread exploitation is not confirmed; however, the trivial attack conditions (unauthenticated, low complexity, network-reachable) mean opportunistic discovery by threat actors is realistic once the flaw is public. SSVC signals: exploitation status unconfirmed, attack is automatable, technical impact is partial (integrity only, constrained file type).

An unauthenticated attacker sends a crafted multipart HTTP POST request directly to the Fabrik list email plugin controller endpoint on a publicly accessible Joomla site running Fabrik 4.7.1 or earlier. The server, performing no authentication check, accepts and writes the attacker-supplied file into the web root. The attacker then retrieves the file via its web-accessible path to serve malicious HTML or SVG content to site visitors, or to chain with a server misconfiguration that permits execution of the uploaded file type. No public POC has been identified at time of analysis.