Skip to main content

Fabrik CVE-2026-76605

| EUVDEUVD-2026-64324 CRITICAL
Code Injection (CWE-94)
2026-08-22 Joomla GHSA-7mjm-m5wm-mfgg
Code Injection RCE Fabrik Extension For Joomla
10.0
CVSS 4.0 · Vendor: Joomla
Share

Severity by source

Vendor (Joomla) PRIMARY
10.0 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
10.0 CRITICAL

Network-reachable unauthenticated code injection with no user interaction (AV:N/AC:L/PR:N/UI:N); RCE escapes the app to compromise the host, so S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 22, 2026 - 15:11 vuln.today
CVE Published
Aug 22, 2026 - 14:20 cve.org
CRITICAL 10.0

DescriptionCVE.org

Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.3 - ???.

AnalysisAI

Remote code execution in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.2) lets remote unauthenticated attackers inject and execute arbitrary code by abusing the image element type, per its CVSS 4.0 base score of 10.0 (CWE-94). The flaw grants full compromise of the underlying Joomla host, with confidentiality, integrity, and availability impact on both the vulnerable application and subsequent systems. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify Joomla site with vulnerable Fabrik
Delivery
Locate exposed image element form
Exploit
Submit crafted code-injection payload
Execution
Payload evaluated in PHP context
Persist
Execute arbitrary code as web server
Impact
Full host compromise
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that a vulnerable Fabrik version (1.0.0-4.7.2) is installed on Joomla and that a form or list exposing the image element type is reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment All signals point to top-tier priority: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity exploitation requiring no privileges and no user interaction, and the full VC:H/VI:H/VA:H plus subsequent-system SC:H/SI:H/SA:H yields a maximal 10.0. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker locates an internet-facing Joomla site running a vulnerable Fabrik version with a form or list that exposes an image element, then submits a crafted request whose image-element input carries an injected code payload. Because exploitation needs no authentication, no user interaction, and low complexity (AV:N/AC:L/PR:N/UI:N), the payload executes in the Joomla PHP context, giving the attacker a web shell or command execution on the server. …
Remediation Upgrade the Fabrik extension to version 4.7.3 or later, which is the first release outside the vulnerable range indicated by 'Fabrik < 4.7.3'; treat 4.7.3 as the fixed version but confirm against the vendor before deployment since no tagged-release advisory URL was provided (only https://www.fabrikar.com/). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct a full inventory of all Joomla installations using Fabrik extension versions 1.0.0-4.7.2 and isolate affected systems from production traffic if operationally feasible. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Fabrik Extension For Joomla

View all
CVE-2026-67282 CRITICAL
10.0 Aug 12

Remote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthe
CVE-2026-66915 CRITICAL
10.0 Aug 10

Remote code execution in the Fabrik application-builder extension for Joomla (versions before 4.6.7) allows unauthentica
CVE-2026-76604 CRITICAL
10.0 Aug 22

Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attac
CVE-2026-76606 CRITICAL
10.0 Aug 22

Path traversal in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through 4.7.2, fixed in 4
CVE-2026-76607 CRITICAL
10.0 Aug 22

Broken access control in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through releases p
CVE-2026-77992 CRITICAL
9.5 Aug 22

Remote code execution in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows attackers to break out of
CVE-2026-76571 CRITICAL
9.3 Aug 22

Unauthenticated SQL injection in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.3, fixe
CVE-2026-76602 CRITICAL
9.3 Aug 22

Unauthenticated SQL injection in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2, fixed in 4.7.3) lets
CVE-2026-76598 HIGH
8.7 Aug 22

Unauthenticated remote attackers can invoke the onAjax_getFolders AJAX method in the Fabrik Extension for Joomla to enum
CVE-2026-76597 HIGH
8.7 Aug 22

Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) version
CVE-2026-76596 HIGH
8.7 Aug 22

Unauthenticated table truncation in the Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) allows any remote att
CVE-2026-76599 HIGH
8.7 Aug 22

Unauthenticated database schema disclosure in Fabrik for Joomla (versions 1.0.0-4.7.1) exposes arbitrary table names, co

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

CVE-2026-76605 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy