EUVD-2026-64322
GHSA-gvj7-4928-2j6w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable endpoint (PR:N/AV:N) but exploitation depends on a specific Fabrik calc configuration, so AC:H; code injection yields full RCE, giving C/I/A:H.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.
AnalysisAI
Remote code execution in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows attackers to break out of a heredoc terminator inside the 'calc' element and inject arbitrary PHP, made reachable because the onUpdateComment endpoint performs no access checks. Any remote actor able to reach the endpoint can trigger evaluation of attacker-controlled code, yielding full compromise of the Joomla application context (CWE-94). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target Joomla site to have the Fabrik extension (≤ 4.7.1) installed and to expose the onUpdateComment endpoint, and requires a form/element path that reaches the vulnerable 'calc' element heredoc processing - this corresponds to the CVSS 4.0 AT:P attack requirement. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N with high vulnerable- and subsequent-system impact, score 9.5) describes an unauthenticated, network-reachable code-injection flaw whose only real gate is an attack requirement (AT:P) - likely that the target deploys a Fabrik form using a calc element and exposes the onUpdateComment endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a Joomla site running Fabrik with a comment-enabled form and sends a crafted request to the unauthenticated onUpdateComment endpoint containing input that closes the calc element's PHP heredoc and appends malicious PHP. The server evaluates the injected code, giving the attacker arbitrary command execution in the web application's context. … |
| Remediation | Upgrade the Fabrik extension to version 4.7.2 or later, which is the first release outside the affected 1.0.0-4.7.1 range (Vendor-released patch: 4.7.2). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Joomla instances running Fabrik 1.0.0-4.7.1, assess network accessibility of affected systems, and establish incident response readiness. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fabrik Extension For Joomla
View allRemote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthe
Remote code execution in the Fabrik application-builder extension for Joomla (versions before 4.6.7) allows unauthentica
Remote code execution in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.2) lets remote
Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attac
Path traversal in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through 4.7.2, fixed in 4
Broken access control in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through releases p
Unauthenticated SQL injection in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.3, fixe
Unauthenticated SQL injection in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2, fixed in 4.7.3) lets
Unauthenticated remote attackers can invoke the onAjax_getFolders AJAX method in the Fabrik Extension for Joomla to enum
Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) version
Unauthenticated table truncation in the Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) allows any remote att
Unauthenticated database schema disclosure in Fabrik for Joomla (versions 1.0.0-4.7.1) exposes arbitrary table names, co
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today