EUVD-2026-64320
GHSA-fq44-8wg9-5qfj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate Joomla site with Fabrik
-
DeliveryIdentify reachable PHP form element
-
ExploitSubmit crafted PHP payload
-
ExecutionExtension evaluates code server-side
-
PersistExecute arbitrary code as web user
-
ImpactDeploy web shell / pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target Joomla installation has the Fabrik extension (version 1.0.0-4.7.2) installed and that a form using Fabrik's PHP form element is reachable by the attacker; that PHP element is the exact feature that evaluates user-supplied code. Consistent with the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication and no user interaction are needed once such a form is exposed. The principal limiting factor is deployment-specific: a site that has Fabrik installed but exposes no form using the PHP element, or restricts that form to authenticated/admin users, materially reduces exposure. Platform is any Joomla/PHP host running the affected Fabrik versions. |
| Impact | This is a genuine top-priority issue, not an inflated high-CVSS score. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA:H and subsequent-system SC/SI/SA:H) describes remote, unauthenticated, no-interaction code execution with full impact and lateral impact to adjacent systems - the maximum 10.0 rating. The vulnerability class (direct PHP code injection) is historically among the most reliably exploitable, so real-world exploitability aligns with the paper score rather than contradicting it. No EPSS score, KEV listing, or public POC is included in the provided data, so widespread automated exploitation cannot yet be confirmed; the absence of KEV means it is not documented as actively exploited at this time, but internet-facing Joomla sites with Fabrik installed should be treated as urgent regardless of organization size. The main uncertainty is operational: exploitation likely requires that a form using the PHP element be reachable, which the terse advisory does not fully specify - verify exposure against your own deployment. |
| Exploit ScenarioDerived | An attacker locates a public Joomla site running a vulnerable Fabrik version that exposes a form built with the PHP form element, then submits a request containing crafted PHP in the targeted field. The extension evaluates the input server-side, executing the attacker's code as the web-server user and giving an unauthenticated foothold that can be escalated to a full web shell. No public POC is confirmed in the provided data, but the network vector and low attack complexity make this trivially reliable once a reachable PHP element is found. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 22, 2026
Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attackers to run arbitrary PHP through the extension's PHP form element, which evaluates user-supplied code. Rated CVSS 10.0 with a network, no-privileges, no-interaction vector and full confidentiality/integrity/availability impact including scope change, this yields complete compromise of the underlying Joomla host. No public exploit identified at time of analysis, but the triviality of PHP-eval injection makes weaponization straightforward once details circulate.
RemediationAI
Upgrade the Fabrik extension to version 4.7.3 or later, which is the vendor-released fix boundary indicated by the 'Fabrik < 4.7.3' advisory; obtain the update from the vendor at https://www.fabrikar.com/. If you cannot patch immediately, remove or disable any Fabrik forms that use the PHP form element, since that specific element is the injection sink - this stops the attack but breaks any legitimate form logic that relied on server-side PHP. As additional compensating controls, restrict network access to the affected Joomla site (for example place it behind authentication or an allowlist), and deploy a WAF rule to inspect and block form submissions targeting Fabrik form-processing endpoints, accepting that WAF filtering of PHP payloads is imperfect and should be treated as a stopgap, not a substitute for the upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Fabrik is an application-builder extension for the Joomla CMS used to create forms, lists, and data-driven visualizations. The affected component is the 'PHP form element', a feature that lets site builders attach PHP logic to form fields. The root cause is CWE-94 (Improper Control of Generation of Code, 'Code Injection'): user-controllable input reaches a PHP execution sink (e.g. eval() or an equivalent dynamic-evaluation path) without adequate isolation, so attacker-provided text is executed as server-side PHP. Per the CPE cpe:2.3:a:fabrikar.com:fabrik_extension_for_joomla, this affects the Fabrik extension itself rather than Joomla core, and runs with the privileges of the PHP/web-server process hosting the Joomla site.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Unauthenticated network PHP code injection (PR:N/AV:N/AC:L) executing in the web-server context escapes the extension boundary to the host, so S:C with full C/I/A impact.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
DescriptionCVE.org
Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.3 - The PHP form element is vulnerable to the execution of user provided codes.
Articles & Coverage 1
Executive ViewAI
The Fabrik extension for Joomla (versions 1.0.0-4.7.2) contains a critical unauthenticated remote code execution vulnerability that allows attackers to achieve complete system compromise without requiring credentials or interaction. No public exploit identified at time of analysis, but the vulnerability's technical simplicity creates high risk of weaponization. Any organization running this extension faces immediate threat of total infrastructure takeover, data theft, and operational disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to Joomla admin and form submission endpoints using firewall/WAF rules; disable PHP form element functionality if extension settings permit; isolate affected systems to network segments with limited trust; implement continuous monitoring for suspicious form submissions and PHP execution patterns; maintain isolated, air-gapped backups for recovery purposes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB