EUVD-2026-57151
GHSA-cr3m-f373-53gv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable frontend code injection with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding full code execution and thus high C/I/A; scope kept unchanged absent evidence of cross-component impact.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unauthenticated attacker could execute arbitrary code by using the frontend listfilter model.
AnalysisAI
Remote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthenticated attacker run arbitrary code on the server via the frontend listfilter model. The flaw is a CWE-94 code injection reachable over the network with no authentication or user interaction, and the vendor rates it maximum severity (CVSS 4.0 base 10.0). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The specific prerequisite is that the target Joomla site runs Fabrik before 4.6.8 with a frontend Fabrik list/filter reachable by unauthenticated visitors - the vulnerable code path is the frontend 'listfilter' model, so the site must expose a Fabrik list that processes filter input from the public frontend. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Every available signal points to critical, actionable risk: the CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with high impact to confidentiality, integrity, and availability of both the vulnerable and subsequent systems, yielding a base score of 10.0 - the maximum. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker locates an internet-facing Joomla site running a vulnerable Fabrik version and sends a crafted HTTP request to a public Fabrik list, embedding malicious code in the listfilter parameters. Because the listfilter model evaluates the attacker-controlled input, the payload executes in the PHP process, giving the attacker code execution to drop a web shell, exfiltrate the Joomla database, or pivot deeper. … |
| Remediation | Upgrade Fabrik to version 4.6.8 or later, which is the vendor-released fix (patch confirms the vulnerable range as < 4.6.8); this is the primary and recommended action, obtained from the vendor at https://www.fabrikar.com/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately disable or remove the Fabrik extension from all production Joomla instances and validate application continuity without it; identify all systems running affected versions and inspect for unauthorized access, new code files, or database modifications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fabrik Extension For Joomla
View allSame weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today