Skip to main content

Fabrik Extension EUVDEUVD-2026-64326

| CVE-2026-76597 HIGH
Improper Access Control (CWE-284)
2026-08-22 Joomla GHSA-4qf9-rq2g-69cw
File Upload Authentication Bypass Fabrik Extension For Joomla
8.7
CVSS 4.0 · Vendor: Joomla
Share

Severity by source

Vendor (Joomla) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable unauthenticated upload endpoint with no prerequisites; scope unchanged as file writes remain within the vulnerable Joomla system; integrity-only impact consistent with non-executable file upload to web root.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 22, 2026 - 15:08 vuln.today
CVE Published
Aug 22, 2026 - 14:20 cve.org
HIGH 8.7

DescriptionCVE.org

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot.

AnalysisAI

Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) versions 1.0.0 through 4.7.1, via the list email plugin controller which applies no access control before processing uploads. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero authentication and zero complexity requirements against any publicly reachable Joomla deployment running the affected extension. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify Joomla site running Fabrik < 4.7.2
Delivery
Locate list email plugin upload endpoint
Exploit
Send unauthenticated multipart POST with crafted file
Execution
Server writes file to web root without auth check
Persist
Access uploaded file via HTTP path
Impact
Deliver malicious content or escalate on misconfigured server
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target Joomla site to have the Fabrik extension (versions 1.0.0 through 4.7.1) installed and the list email plugin enabled and accessible. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N accurately reflects the zero-barrier network attack surface and high integrity impact on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker sends a crafted multipart HTTP POST request directly to the Fabrik list email plugin controller endpoint on a publicly accessible Joomla site running Fabrik 4.7.1 or earlier. The server, performing no authentication check, accepts and writes the attacker-supplied file into the web root. …
Remediation The primary remediation is to upgrade the Fabrik extension to version 4.7.2 or later, which addresses the improper access control in the list email plugin controller. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Joomla deployments and identify those running Fabrik versions 1.0.0 through 4.7.1; disable or remove the Fabrik plugin immediately and review recent file uploads for unauthorized content. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Fabrik Extension For Joomla

View all
CVE-2026-67282 CRITICAL
10.0 Aug 12

Remote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthe
CVE-2026-66915 CRITICAL
10.0 Aug 10

Remote code execution in the Fabrik application-builder extension for Joomla (versions before 4.6.7) allows unauthentica
CVE-2026-76605 CRITICAL
10.0 Aug 22

Remote code execution in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.2) lets remote

CVE-2026-76604 CRITICAL
10.0 Aug 22

Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attac
CVE-2026-76606 CRITICAL
10.0 Aug 22

Path traversal in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through 4.7.2, fixed in 4
CVE-2026-76607 CRITICAL
10.0 Aug 22

Broken access control in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through releases p
CVE-2026-77992 CRITICAL
9.5 Aug 22

Remote code execution in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows attackers to break out of
CVE-2026-76571 CRITICAL
9.3 Aug 22

Unauthenticated SQL injection in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.3, fixe
CVE-2026-76602 CRITICAL
9.3 Aug 22

Unauthenticated SQL injection in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2, fixed in 4.7.3) lets
CVE-2026-76598 HIGH
8.7 Aug 22

Unauthenticated remote attackers can invoke the onAjax_getFolders AJAX method in the Fabrik Extension for Joomla to enum
CVE-2026-76596 HIGH
8.7 Aug 22

Unauthenticated table truncation in the Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) allows any remote att
CVE-2026-76599 HIGH
8.7 Aug 22

Unauthenticated database schema disclosure in Fabrik for Joomla (versions 1.0.0-4.7.1) exposes arbitrary table names, co

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique File Upload

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2017-12617 HIGH POC
8.1
CVE-2020-1938 CRITICAL POC
9.8
CVE-2024-50623 CRITICAL POC
9.8
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2018-9206 CRITICAL POC
9.8
CVE-2024-5084 CRITICAL POC
9.8

Share

EUVD-2026-64326 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy