Fabrik Extension CVE-2026-76598

No special conditions are required beyond the presence of the Fabrik Extension for Joomla in versions 1.0.0 through 4.7.1 and network reachability of the Joomla AJAX endpoint - the onAjax_getFolders method is part of the extension's standard AJAX functionality and requires no non-default configuration or unusual deployment mode. Exploitation is unauthenticated (PR:N, UI:N per the provided CVSS 4.0 vector). Limiting factors include: the target site must have the Fabrik extension installed and active; the AJAX endpoint must not be blocked by upstream WAF or firewall rules; and the depth of directory traversal is bounded by the OS-level file system permissions of the web server process, meaning files outside the web root or restricted by OS ACLs may not be enumerable even when the vulnerability is triggered.

The CVSS 4.0 base score of 8.7 reflects an unauthenticated, network-reachable endpoint requiring no complexity or interaction (AV:N/AC:L/AT:N/PR:N/UI:N), which accurately captures the low barrier to exploitation. A notable data-quality discrepancy exists in the provided vector: it assigns VC:N (no confidentiality impact to the vulnerable system) paired with VI:H (high integrity impact), which is inconsistent with the described attack outcome of arbitrary directory listing - a quintessentially confidentiality-impacting operation that does not inherently grant write or modification capabilities. This metric mismatch should be verified against the vendor advisory before making authoritative risk decisions. No EPSS score was supplied in the available intelligence, preventing probabilistic quantification of exploitation likelihood. The vulnerability is absent from CISA KEV and no POC has been identified at time of analysis, which moderates urgency relative to the raw score. However, the unauthenticated network vector means any internet-exposed Joomla installation running Fabrik 1.0.0-4.7.1 is trivially enumerable by automated scanners, and the upgrade to 4.7.2 should be treated as a priority action for any organization running this extension.

An unauthenticated attacker sends a crafted HTTP request to the Joomla site's AJAX handler targeting the Fabrik component's onAjax_getFolders method with an attacker-controlled directory path as the parameter. The server returns a listing of the specified directory, enabling the attacker to map the server's file system, locate configuration files, backup archives, or credential stores for use in follow-on attacks. No exploit code has been publicly identified at time of analysis, but the attack requires no credentials and is straightforward to reproduce given the vulnerability description.