Fabrik EUVD-2026-64322

Exploitation requires the target Joomla site to have the Fabrik extension (≤ 4.7.1) installed and to expose the onUpdateComment endpoint, and requires a form/element path that reaches the vulnerable 'calc' element heredoc processing - this corresponds to the CVSS 4.0 AT:P attack requirement. No authentication is needed because the onUpdateComment endpoint performs no access checks (PR:N) and no user interaction is required (UI:N). The limiting factors are therefore configuration-driven: the site must actually use Fabrik and the relevant calc/comment functionality; installations without Fabrik, or without the affected element in use, are not exploitable. Platform requirement is a PHP/Joomla deployment of Fabrik below 4.7.2.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N with high vulnerable- and subsequent-system impact, score 9.5) describes an unauthenticated, network-reachable code-injection flaw whose only real gate is an attack requirement (AT:P) - likely that the target deploys a Fabrik form using a calc element and exposes the onUpdateComment endpoint. Because PR:N combined with the explicitly noted absence of access checks means no authentication is required, and CWE-94 code injection maps to full RCE, this is a genuine high priority rather than an inflated high-CVSS score. Tempering that: there is no KEV listing, no POC referenced, and no EPSS value provided, so active-exploitation and mass-scanning risk cannot be confirmed - the AT:P requirement suggests exploitation depends on a specific Fabrik configuration rather than every Joomla install. Organizations running Fabrik should treat this as urgent and patch promptly, while noting that the lack of exploit evidence means prioritization rests on the severity of the code path, not observed attacks.

An attacker identifies a Joomla site running Fabrik with a comment-enabled form and sends a crafted request to the unauthenticated onUpdateComment endpoint containing input that closes the calc element's PHP heredoc and appends malicious PHP. The server evaluates the injected code, giving the attacker arbitrary command execution in the web application's context. No public POC is referenced, but the low attack complexity (AC:L) and lack of authentication make weaponization straightforward once the specific vulnerable configuration is located.