Fabrik CVE-2026-76605

Exploitation requires that a vulnerable Fabrik version (1.0.0-4.7.2) is installed on Joomla and that a form or list exposing the image element type is reachable by the attacker. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no special attack requirements, and no user interaction are needed against such a configuration - remote unauthenticated exploitation is possible wherever the image element is exposed. The practical limiting factor is deployment-specific: sites that do not use the image element, or that keep Fabrik forms behind authentication/IP restrictions, present a much smaller or no attack surface; the exact triggering input is not fully documented in the terse description and should be confirmed with the vendor.

All signals point to top-tier priority: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity exploitation requiring no privileges and no user interaction, and the full VC:H/VI:H/VA:H plus subsequent-system SC:H/SI:H/SA:H yields a maximal 10.0. RCE with CWE-94 on an internet-facing CMS extension is exactly the profile that tends to be automated once an exploit surfaces. Two signals are notably absent and should temper certainty rather than lower priority: there is no EPSS probability in the input to gauge real-world exploitation likelihood, and there is no KEV or POC evidence, so active exploitation is unconfirmed. The description is also terse ('via image element ... - ???'), so the precise injection mechanism is not fully documented - verify specifics with the vendor before finalizing detection logic. Given maximal impact and trivial exploitation conditions, treat as critical and patch immediately even though widespread exploitation is not yet demonstrated.

An attacker locates an internet-facing Joomla site running a vulnerable Fabrik version with a form or list that exposes an image element, then submits a crafted request whose image-element input carries an injected code payload. Because exploitation needs no authentication, no user interaction, and low complexity (AV:N/AC:L/PR:N/UI:N), the payload executes in the Joomla PHP context, giving the attacker a web shell or command execution on the server. No public exploit code is identified at this time, so this scenario is derived from the CVSS vector and CWE-94 classification rather than an observed exploit.