Fabrik CVE-2026-76606

Exploitation targets the Fabrik 'image element' field type, so a prerequisite is that the Joomla site runs a vulnerable Fabrik version (1.0.0-4.7.2) and exposes at least one Fabrik form/list that uses the image element and is reachable by the attacker. The vendor CVSS vector (PR:N, UI:N, AV:N) indicates no authentication or user interaction is required and the attack is remote over the network, implying default reachability of the affected endpoint; however, the exact description is truncated ('???') in the source, so whether a specific form must be published or a particular element configured is not fully confirmed and should be validated against the vendor advisory. Limiting factors are therefore the presence and public accessibility of an image-element-bearing Fabrik component and the running of a pre-4.7.3 version.

The signals are partly one-sided: the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with full VC/VI/VA:H and subsequent-system SC/SI/SA:H) yields a maximal 10.0, implying trivially reachable, unauthenticated, high-impact exploitation with scope crossing into other systems. However, no EPSS score, no KEV listing, and no POC were provided, so real-world exploitation is currently unproven - this is a high-severity-on-paper finding whose realized risk depends on whether the image element is reachable pre-authentication and whether the traversal permits write/execute or only read. The claim of full integrity/availability and subsequent-system impact is aggressive for a path traversal and is worth verifying against the vendor's own writeup, since many traversal bugs are read-only (confidentiality-dominant). Given Fabrik's role in handling form submissions and file paths, any operator running a version below 4.7.3 should prioritize patching promptly, but the absence of exploitation telemetry suggests treating this as an urgent patch rather than confirmed active compromise.

An attacker submits a crafted request to a Fabrik form containing an image element, supplying a manipulated path (e.g., traversal sequences) so the extension reads from or writes to a location outside the designated image directory. Depending on whether the flaw permits write access, this could expose sensitive files such as Joomla's configuration.php (database credentials) or, in a worse case, plant a file leading to code execution. No public proof-of-concept was identified at time of analysis, and the CVSS AC:L rating suggests the attack does not require special timing or complex preconditions.