EUVD-2026-64331
GHSA-p5vh-m7cp-f4v4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated remote path traversal (AV:N/AC:L/PR:N/UI:N) most reliably yields arbitrary file read (C:H); write/execute is unconfirmed so I:L and A:N, and no clear scope change (S:U).
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.3 - ???.
AnalysisAI
Path traversal in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through 4.7.2, fixed in 4.7.3) lets remote attackers manipulate file paths through the image element to reach files outside the intended directory. The vendor's CVSS 4.0 score of 10.0 with PR:N indicates unauthenticated network exploitation, though there is no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets the Fabrik 'image element' field type, so a prerequisite is that the Joomla site runs a vulnerable Fabrik version (1.0.0-4.7.2) and exposes at least one Fabrik form/list that uses the image element and is reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are partly one-sided: the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with full VC/VI/VA:H and subsequent-system SC/SI/SA:H) yields a maximal 10.0, implying trivially reachable, unauthenticated, high-impact exploitation with scope crossing into other systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted request to a Fabrik form containing an image element, supplying a manipulated path (e.g., traversal sequences) so the extension reads from or writes to a location outside the designated image directory. Depending on whether the flaw permits write access, this could expose sensitive files such as Joomla's configuration.php (database credentials) or, in a worse case, plant a file leading to code execution. … |
| Remediation | Upgrade Fabrik to version 4.7.3 or later, which the EUVD data identifies as the fixed release; obtain the update from the vendor at https://www.fabrikar.com/ (no direct advisory link was provided in the source data, so verify the exact patched build on the vendor's download/changelog page). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Joomla installations to identify those running Fabrik versions 4.7.2 or earlier and assess exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fabrik Extension For Joomla
View allRemote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthe
Remote code execution in the Fabrik application-builder extension for Joomla (versions before 4.6.7) allows unauthentica
Remote code execution in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.2) lets remote
Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attac
Broken access control in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through releases p
Remote code execution in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows attackers to break out of
Unauthenticated SQL injection in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.3, fixe
Unauthenticated SQL injection in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2, fixed in 4.7.3) lets
Unauthenticated remote attackers can invoke the onAjax_getFolders AJAX method in the Fabrik Extension for Joomla to enum
Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) version
Unauthenticated table truncation in the Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) allows any remote att
Unauthenticated database schema disclosure in Fabrik for Joomla (versions 1.0.0-4.7.1) exposes arbitrary table names, co
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today