EUVD-2026-55159
GHSA-ch8m-c7x9-7r7f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated remote code injection over the network with no user interaction; scope changed (S:C) as injected code affects the host OS/other components beyond the Joomla app.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.6.7 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the calc plugin.
AnalysisAI
Remote code execution in the Fabrik application-builder extension for Joomla (versions before 4.6.7) allows unauthenticated attackers to execute arbitrary code by abusing the ajax_calc endpoint of the bundled calc form plugin. The calc plugin evaluates user-influenced expressions server-side, and the AJAX handler exposes that evaluation without authentication, giving remote attackers full control of the underlying PHP process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Joomla site has the Fabrik extension (version < 4.6.7) installed and that the calc plugin's 'ajax_calc' AJAX feature is reachable over the network - this is the exact prerequisite named in the description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue, not an inflated high-CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scanning the internet for Joomla sites running Fabrik sends a crafted HTTP request to the com_fabrik component invoking the calc plugin's ajax_calc task with a malicious PHP expression as input. Because the endpoint requires no authentication and evaluates the expression server-side, the attacker's code runs in the web application's PHP context, yielding a webshell or command execution. … |
| Remediation | Upgrade Fabrik to version 4.6.7 or later, which is the first fixed release per the CVE's '< 4.6.7' boundary (Vendor-released patch: 4.6.7). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Joomla instances running Fabrik versions prior to 4.6.7, particularly in production environments, and immediately disable the calc form plugin or restrict network access to the ajax_calc endpoint using firewall or WAF rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fabrik Extension For Joomla
View allSame weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today