Fabrik 4.7.2 for Joomla: A Long List of Security Fixes

Fabrikar released Fabrik 4.7.2 for Joomla on 22 August 2026. It is a security release, and it closes a long list of unauthenticated vulnerabilities in the application and form builder, most of them found and reported by mySites.guru and credited to us by name in Fabrik’s own changelog.

If you run Fabrik on any Joomla site, update now. The current release is 4.7.3, a bug-fix follow-up from 24 August that includes everything 4.7.2 closed. This post is the plain list of what it fixes and what to do. For the back-story of how the 4.7.x line got here, across 4.6.7, 4.6.8, 4.7.0 and 4.7.1, see The Fabrik Fiasco.

TL;DR

• Fabrik 4.7.2 (22 August 2026) is a security release closing a long list of unauthenticated vulnerabilities: remote code execution, SQL injection, arbitrary file upload, directory listing, database table listing, row disclosure, comment manipulation, path traversal and a heredoc breakout
• Most of the fixes are credited to mySites.guru in Fabrik’s changelog
• The Joomla CNA has published seventeen CVE records, and sixteen credit mySites.guru as the finder, four of those at CVSS 10.0
• Update every Fabrik install to 4.7.3 (24 August 2026), a bug-fix follow-up that has every security fix in 4.7.2 plus repairs for two 404 regressions, and whose version number, unlike the re-issued 4.7.2 builds, tells you exactly what you have
• Joomla 3 sites cannot install any Fabrik 4 release. There is a manual one-line vendor patch for the calc flaw, offered as-is; plan removal or migration
• mySites.guru flags every connected Joomla site running Fabrik below 4.7.2

The full list of fixes

The Joomla CNA has published seventeen CVE records for this release, and sixteen of them credit mySites.guru as the finder, four of those at the maximum CVSS 10.0. They are listed here worst first, and every CVE links to its published record. One of the seventeen, the database table listing, appears in no version of Fabrik’s changelog at all; its CVE record is the only public documentation it has.

Fabrik 4.7.2 also re-closed a regression of the original calc-element flaw, CVE-2026-66915, which had been reachable again through a second placeholder substituter; the changelog credits mySites.guru with reporting that regression. The two remote code execution flaws that started this whole run, CVE-2026-66915 in the calc element (reported by Moe Khalilov of LeetProtect Research) and CVE-2026-67282 in the list filter model (reported by Murad Gasimov), were both scored CVSS 4.0 10.0 Critical and fixed earlier in the 4.6.x line.

Just how bad is this?

Honestly, about as bad as an extension vulnerability set gets. Four of these are scored CVSS 10.0, the maximum, and each of the four is reachable by an anonymous visitor with no login: two are direct remote code execution, one is a path traversal in the image element, and one strips out an access check. Add the 9.5 heredoc breakout and the two 9.3 SQL injections and that is seven Critical-rated unauthenticated flaws in a single component, before you count the Highs and the Mediums.

We have been finding and reporting Joomla extension vulnerabilities for years, and a list this long and this severe closed in one release is among the worst we have seen in a long time. If you run Fabrik, treat it that way. Any version below 4.7.2 should be assumed exposed, and the sites most at risk are the ones that publish a Fabrik form or list a visitor can reach without logging in.

What to do

1. Update every Fabrik install to 4.7.3. It is the current release, published 24 August 2026, and it contains every security fix from 4.7.2 plus repairs for two 404 regressions that 4.7.2 introduced, on links to Fabrik pages from outside websites and on HEAD requests. It needs a valid Fabrik subscription, and this time it is in Fabrik’s Joomla update feed, so the Joomla updater should offer it; if it does not, download it from My Download Files on fabrikar.com. A site showing 4.7.3 has the full fix set, which the version string alone could never tell you on the re-issued 4.7.2 builds.
2. Test before you deploy. 4.7.x is a real upgrade rather than a point release: it breaks any userAjax calls you use, and sites running the FullCalendar or Paypal plugins need those updated to current versions at the same time. Install and test on a sandbox before a live site.
3. Joomla 3 sites need a different plan. Fabrik 4 installs on Joomla 4.2 and above and Joomla 5.1 and above only. There is no patched Fabrik 3 release. The vendor has published a manual one-line source patch for the calc flaw in its Announcements forum, offered as-is with no warranty; apply it as a stopgap while you plan removal or migration.
4. Check exposed sites for compromise. An unauthenticated flaw leaves no login trail, so updating does not tell you whether a site was already hit. Look for unfamiliar administrator accounts, recently modified or unexpected PHP files, and scheduled tasks you did not create.

Finding every Fabrik install across your Joomla sites

The hard part of a list like this is not the fix, it is finding every site that needs it before an attacker does. mySites.guru keeps a live inventory of every extension on every connected Joomla site and flags the ones running an affected version of Fabrik, so this turns into a filtered list rather than an afternoon of logging into control panels. We flag every Fabrik install running any version below 4.7.2.

At a glance