Fabrik (com_fabrik) below 4.7.0 - Unauthenticated Remote Code Execution

Fabrik has now shipped three security releases in five days, and 4.7.0 is the version to be on. Both published flaws are unauthenticated remote code execution, both scored CVSS 4.0 10.0 Critical, and both are CWE-94 code injection. CVE-2026-66915 is in the calc element plugin: the calc element evaluates a PHP expression to compute a field value, and its AJAX recalculation feature (ajax_calc) could be reached by an anonymous visitor with no login and no user interaction. Fabrik 4.6.7 (9 August 2026) was released to fix it. That fix was incomplete. On 12 August 2026 the Joomla CNA revised the CVE record: the affected range was widened from 1.0.0-4.6.6 to 1.0.0-4.6.8, and the fixed version restated as 4.6.9. So 4.6.8 is still vulnerable to this flaw despite being the version the earlier advice pointed at. CVE-2026-67282 (published 12 August 2026, reported by Murad Gasimov) is the flaw behind the terse "Security fix for list filters" line in 4.6.8: an unauthenticated attacker could execute arbitrary code through the front end list filter model. Affected 1.0.0-4.6.7, fixed in 4.6.8. IMPORTANT: there is no public Fabrik 4.6.9. It is not on the vendor download listing, has no changelog entry, and its info page returns 404. The only publicly downloadable release that satisfies the revised CVE-2026-66915 ceiling is 4.7.0, released 13 August 2026 and described by the vendor as "a major hardening release against PHP eval attack vectors" and "a major security release". Update to 4.7.0. Upgrade notes from the vendor: 4.7.0 breaks any existing userAjax calls, and sites using the FullCalendar or Paypal plugins must update those to their current versions at the same time. Test on a staging copy first. Reach: Fabrik 4.x installs only on Joomla 4.2+ and Joomla 5.1+, and the vendor states Fabrik 4 will not install on Joomla 6. Downloading updates requires a valid Fabrik subscription. Joomla 3 sites: there is still no patched release on the Fabrik 3.x branch (last release 3.10, August 2021) and the vendor has confirmed there never will be, saying it does not own the F3 source repository and cannot publish releases to it. However, on 11 August 2026 a Fabrik administrator published a manual one-line source patch for F3 covering the calc element flaw only, in the Announcements forum: in plugin/fabrik_element/calc/calc.php, add two true arguments to the parseMessageForPlaceHolder call. It is offered as-is with no warranty. The vendor states the second attack vector (the list filter one) does not affect F3. This is a partial, unsupported mitigation, not a fix, and the vendor strongly urges migration to Fabrik 4. Interim mitigation on any site that cannot update: unpublish public-facing Fabrik forms and lists. Also within this rule: CVE-2020-37219 (Fabrik 3.9.11), which sits below this ceiling and needs no separate row. Getting 4.7.0 is the hard part, and this is why your Joomla updater probably shows nothing. Fabrik left 4.7.0 out of its update feed at release and added it on 16 August 2026 tagged as a release candidate. Joomla's Minimum Extension Stability setting defaults to Stable and silently discards anything below that, so set it to Release Candidate under System > Update > Extensions > Options. Separately, the feed's targetplatform for both 4.7.0 and 4.6.8 is "5.[4]", which Joomla treats as a regular expression against the running Joomla version: it matches Joomla 5.4.x only, so on Joomla 4.2 through 5.3 neither is ever offered whatever the stability setting. On those sites the only route is a manual download from My Download Files on fabrikar.com, installed via Extensions > Install. On 16 August 2026 mySites.guru obtained the 4.7.0 package (SHA-256 matching the vendor's own update feed) and audited the source, which has never been published anywhere. Both flaws are properly fixed, and fixed structurally: eval() now appears in two files out of 869, and the helper compiles the site builder's code once and binds request data as PHP variables instead of substituting it into the code as text. We found no remaining route from an unauthenticated request to code execution. Note that the vendor relabelled 4.7.0 from Stable to Release Candidate on 16 August, on the same build. It is still the version to be on.

How CVE-2020-37219 is scored

The base metrics as VulnCheck CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

Timeline

1. 13 May 2026CVE-2020-37219 record published by its CNA
2. 13 May 2026mySites.guru check added for Fabrik (before 4.7.0)
3. 10 August 2026We published: The Fabrik Fiasco: Announced, Restricted, Relabelled

Rule details

Our disclosure post

The Fabrik Fiasco: Announced, Restricted, Relabelled

Two CVSS 10.0 RCEs in the Fabrik Joomla extension, and a chaotic run of security releases since. The vendor has moved past 4.7.0; be on 4.7.2.

10 Aug 2026

Other vulnerabilities in Fabrik

Updating for CVE-2020-37219 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

References

• CVE-2020-37219 on cve.org (the official CVE record)
• CVE-2020-37219 in the NIST National Vulnerability Database
• The Fabrik Fiasco: Announced, Restricted, Relabelled