Fabrik 4.7.2 for Joomla: A Long List of Security Fixes

Fabrikar released Fabrik 4.7.2 for Joomla on 22 August 2026. It is a security release, and it closes a long list of unauthenticated vulnerabilities in the application and form builder, most of them found and reported by mySites.guru and credited to us by name in Fabrik’s own changelog.

If you run Fabrik on any Joomla site, update to the latest 4.7.2 build now. This post is the plain list of what it fixes and what to do. For the back-story of how the 4.7.x line got here, across 4.6.7, 4.6.8, 4.7.0 and 4.7.1, see The Fabrik Fiasco.

TL;DR

• Fabrik 4.7.2 (22 August 2026) is a security release closing a long list of unauthenticated vulnerabilities: remote code execution, SQL injection, arbitrary file upload, directory listing, row disclosure, comment manipulation, path traversal and a heredoc breakout
• Most of the fixes are credited to mySites.guru in Fabrik’s changelog
• The Joomla CNA has published a CVE record for every one, and fifteen credit mySites.guru as the finder, four of those at CVSS 10.0
• Update every Fabrik install to the latest 4.7.2 build, downloaded fresh from fabrikar.com. Re-download it even if a site already shows 4.7.2, because 4.7.2 has been re-issued more than once under the same version number
• Joomla 3 sites cannot install any Fabrik 4 release. There is a manual one-line vendor patch for the calc flaw, offered as-is; plan removal or migration
• mySites.guru flags every connected Joomla site running Fabrik through 4.7.2

The full list of fixes

The Joomla CNA has published a CVE record for every one of these, and fifteen of them credit mySites.guru as the finder, four of those at the maximum CVSS 10.0. They are listed here worst first, with the vendor’s own description of each. Every CVE links to its published record.

Fabrik 4.7.2 also re-closed a regression of the original calc-element flaw, CVE-2026-66915, which had been reachable again through a second placeholder substituter; the changelog credits mySites.guru with reporting that regression. The two remote code execution flaws that started this whole run, CVE-2026-66915 in the calc element (reported by Moe Khalilov of LeetProtect Research) and CVE-2026-67282 in the list filter model (reported by Murad Gasimov), were both scored CVSS 4.0 10.0 Critical and fixed earlier in the 4.6.x line.

Just how bad is this?

Honestly, about as bad as an extension vulnerability set gets. Four of these are scored CVSS 10.0, the maximum, and each of the four is reachable by an anonymous visitor with no login: two are direct remote code execution, one is a path traversal in the image element, and one strips out an access check. Add the 9.5 heredoc breakout and the two 9.3 SQL injections and that is seven Critical-rated unauthenticated flaws in a single component, before you count the Highs and the Mediums.

We have been finding and reporting Joomla extension vulnerabilities for years, and a list this long and this severe closed in one release is among the worst we have seen in a long time. If you run Fabrik, treat it that way. Any version below 4.7.2 should be assumed exposed, and the sites most at risk are the ones that publish a Fabrik form or list a visitor can reach without logging in.

What to do

1. Update every Fabrik install to the latest 4.7.2 build. Download it fresh from My Download Files on fabrikar.com, and re-download it even if a site already reports 4.7.2, because the package has been re-issued more than once under the same version number. It needs a valid Fabrik subscription, and Joomla’s updater will not offer it at default settings, so this is a manual download and install.
2. Test before you deploy. 4.7.x is a real upgrade rather than a point release: it breaks any userAjax calls you use, and sites running the FullCalendar or Paypal plugins need those updated to current versions at the same time. Install and test on a sandbox before a live site.
3. Joomla 3 sites need a different plan. Fabrik 4 installs on Joomla 4.2 and above and Joomla 5.1 and above only. There is no patched Fabrik 3 release. The vendor has published a manual one-line source patch for the calc flaw in its Announcements forum, offered as-is with no warranty; apply it as a stopgap while you plan removal or migration.
4. Check exposed sites for compromise. An unauthenticated flaw leaves no login trail, so updating does not tell you whether a site was already hit. Look for unfamiliar administrator accounts, recently modified or unexpected PHP files, and scheduled tasks you did not create.

Finding every Fabrik install across your Joomla sites

The hard part of a list like this is not the fix, it is finding every site that needs it before an attacker does. mySites.guru keeps a live inventory of every extension on every connected Joomla site and flags the ones running an affected version of Fabrik, so this turns into a filtered list rather than an afternoon of logging into control panels. We flag every Fabrik install through 4.7.2 while we independently verify the latest build.

At a glance

Further Reading

• The Fabrik Fiasco: Announced, Restricted, Relabelled, the back-story across 4.6.7 to 4.7.0
• Fabrik’s changelog history, the vendor’s own record of the fixes
• CVE-2026-66915 and CVE-2026-67282 at CVE.org, the two originally published remote code execution flaws
• Every security announcement we have published, the full archive, which this release joins
• AJAX endpoints are a big CMS security blind spot, the pattern behind most of the flaws in the list above
• Twenty rules for Joomla extension developers handling a security report, the standard this release is measured against