Affected versions: < 4.7.0
Full advisory: our disclosure post
CVE-2020-37219HighPublished 13 May 2026
Fabrik (com_fabrik) below 4.7.0 - Unauthenticated Remote Code Execution
Fabrik has now shipped three security releases in five days, and 4.7.0 is the version to be on. Both published flaws are unauthenticated remote code execution, both scored CVSS 4.0 10.0 Critical, and both are CWE-94 code injection. CVE-2026-66915 is in the calc element plugin: the calc element evaluates a PHP expression to compute a field value, and its AJAX recalculation feature (ajax_calc) could be reached by an anonymous visitor with no login and no user interaction. Fabrik 4.6.7 (9 August 2026) was released to fix it. That fix was incomplete. On 12 August 2026 the Joomla CNA revised the CVE record: the affected range was widened from 1.0.0-4.6.6 to 1.0.0-4.6.8, and the fixed version restated as 4.6.9. So 4.6.8 is still vulnerable to this flaw despite being the version the earlier advice pointed at. CVE-2026-67282 (published 12 August 2026, reported by Murad Gasimov) is the flaw behind the terse "Security fix for list filters" line in 4.6.8: an unauthenticated attacker could execute arbitrary code through the front end list filter model. Affected 1.0.0-4.6.7, fixed in 4.6.8. IMPORTANT: there is no public Fabrik 4.6.9. It is not on the vendor download listing, has no changelog entry, and its info page returns 404. The only publicly downloadable release that satisfies the revised CVE-2026-66915 ceiling is 4.7.0, released 13 August 2026 and described by the vendor as "a major hardening release against PHP eval attack vectors" and "a major security release". Update to 4.7.0. Upgrade notes from the vendor: 4.7.0 breaks any existing userAjax calls, and sites using the FullCalendar or Paypal plugins must update those to their current versions at the same time. Test on a staging copy first. Reach: Fabrik 4.x installs only on Joomla 4.2+ and Joomla 5.1+, and the vendor states Fabrik 4 will not install on Joomla 6. Downloading updates requires a valid Fabrik subscription. Joomla 3 sites: there is still no patched release on the Fabrik 3.x branch (last release 3.10, August 2021) and the vendor has confirmed there never will be, saying it does not own the F3 source repository and cannot publish releases to it. However, on 11 August 2026 a Fabrik administrator published a manual one-line source patch for F3 covering the calc element flaw only, in the Announcements forum: in plugin/fabrik_element/calc/calc.php, add two true arguments to the parseMessageForPlaceHolder call. It is offered as-is with no warranty. The vendor states the second attack vector (the list filter one) does not affect F3. This is a partial, unsupported mitigation, not a fix, and the vendor strongly urges migration to Fabrik 4. Interim mitigation on any site that cannot update: unpublish public-facing Fabrik forms and lists. Also within this rule: CVE-2020-37219 (Fabrik 3.9.11), which sits below this ceiling and needs no separate row. Getting 4.7.0 is the hard part, and this is why your Joomla updater probably shows nothing. Fabrik left 4.7.0 out of its update feed at release and added it on 16 August 2026 tagged as a release candidate. Joomla's Minimum Extension Stability setting defaults to Stable and silently discards anything below that, so set it to Release Candidate under System > Update > Extensions > Options. Separately, the feed's targetplatform for both 4.7.0 and 4.6.8 is "5.[4]", which Joomla treats as a regular expression against the running Joomla version: it matches Joomla 5.4.x only, so on Joomla 4.2 through 5.3 neither is ever offered whatever the stability setting. On those sites the only route is a manual download from My Download Files on fabrikar.com, installed via Extensions > Install. On 16 August 2026 mySites.guru obtained the 4.7.0 package (SHA-256 matching the vendor's own update feed) and audited the source, which has never been published anywhere. Both flaws are properly fixed, and fixed structurally: eval() now appears in two files out of 869, and the helper compiles the site builder's code once and binds request data as PHP variables instead of substituting it into the code as text. We found no remaining route from an unauthenticated request to code execution. Note that the vendor relabelled 4.7.0 from Stable to Release Candidate on 16 August, on the same build. It is still the version to be on.
Affected versions: < 4.7.0
Official record: cve.org · NVD
Related vulnerabilities
Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.
Affected extensions and versions
Our disclosure post
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 25 August 2026.