# Fabrik security vulnerabilities

[Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/Fabrik

# Fabrik security vulnerabilities

mySites.guru tracks 2 vulnerabilities in Fabrik (com\_fabrik), covering 20 CVEs. Every connected Joomla site is checked against them on each audit.

## Is my site affected?

Your site is affected if it runs Fabrik in any of these ranges:

-   from 4.7.0 up to but not including 4.7.2
-   before 4.7.0

- **Latest safe version** - 4.7.2 or later. No rule we check matches that release or any newer one.
- **What to do** - Update Fabrik to 4.7.2 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.

[Check whether your sites are affected](https://mysites.guru/free-audit/)

## Every Fabrik vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVE

Affected versions

Fixed in

Severity

Added

[CVE-2026-76571](https://mysites.guru/vulnerabilities/CVE-2026-76571/)CVSS 9.3[CVE-2026-76596](https://mysites.guru/vulnerabilities/CVE-2026-76596/)CVSS 8.7[CVE-2026-76597](https://mysites.guru/vulnerabilities/CVE-2026-76597/)CVSS 8.7[CVE-2026-76598](https://mysites.guru/vulnerabilities/CVE-2026-76598/)CVSS 8.7[CVE-2026-76600](https://mysites.guru/vulnerabilities/CVE-2026-76600/)CVSS 6.9[CVE-2026-76601](https://mysites.guru/vulnerabilities/CVE-2026-76601/)CVSS 6.9[CVE-2026-76602](https://mysites.guru/vulnerabilities/CVE-2026-76602/)CVSS 9.3[CVE-2026-76603](https://mysites.guru/vulnerabilities/CVE-2026-76603/)CVSS 6.9[CVE-2026-76604](https://mysites.guru/vulnerabilities/CVE-2026-76604/)CVSS 10.0[CVE-2026-76605](https://mysites.guru/vulnerabilities/CVE-2026-76605/)CVSS 10.0[CVE-2026-76606](https://mysites.guru/vulnerabilities/CVE-2026-76606/)CVSS 10.0[CVE-2026-76607](https://mysites.guru/vulnerabilities/CVE-2026-76607/)CVSS 10.0[CVE-2026-76608](https://mysites.guru/vulnerabilities/CVE-2026-76608/)CVSS 6.9[CVE-2026-76609](https://mysites.guru/vulnerabilities/CVE-2026-76609/)CVSS 6.9[CVE-2026-77027](https://mysites.guru/vulnerabilities/CVE-2026-77027/)CVSS 8.6[CVE-2026-77992](https://mysites.guru/vulnerabilities/CVE-2026-77992/)CVSS 9.5[CVE-2026-76599](https://mysites.guru/vulnerabilities/CVE-2026-76599/)CVSS 8.7

from 4.7.0 up to but not including 4.7.2

4.7.2

Critical

2026-08-22

[CVE-2020-37219](https://mysites.guru/vulnerabilities/CVE-2020-37219/)CVSS 8.7[CVE-2026-67282](https://mysites.guru/vulnerabilities/CVE-2026-67282/)CVSS 10.0[CVE-2026-66915](https://mysites.guru/vulnerabilities/CVE-2026-66915/)CVSS 10.0

before 4.7.0

4.7.0

High

2026-05-13

## What we check for

Critical[CVE-2026-76571](https://mysites.guru/vulnerabilities/CVE-2026-76571/)[CVE-2026-76596](https://mysites.guru/vulnerabilities/CVE-2026-76596/)[CVE-2026-76597](https://mysites.guru/vulnerabilities/CVE-2026-76597/)[CVE-2026-76598](https://mysites.guru/vulnerabilities/CVE-2026-76598/)[CVE-2026-76600](https://mysites.guru/vulnerabilities/CVE-2026-76600/)[CVE-2026-76601](https://mysites.guru/vulnerabilities/CVE-2026-76601/)[CVE-2026-76602](https://mysites.guru/vulnerabilities/CVE-2026-76602/)[CVE-2026-76603](https://mysites.guru/vulnerabilities/CVE-2026-76603/)[CVE-2026-76604](https://mysites.guru/vulnerabilities/CVE-2026-76604/)[CVE-2026-76605](https://mysites.guru/vulnerabilities/CVE-2026-76605/)[CVE-2026-76606](https://mysites.guru/vulnerabilities/CVE-2026-76606/)[CVE-2026-76607](https://mysites.guru/vulnerabilities/CVE-2026-76607/)[CVE-2026-76608](https://mysites.guru/vulnerabilities/CVE-2026-76608/)[CVE-2026-76609](https://mysites.guru/vulnerabilities/CVE-2026-76609/)[CVE-2026-77027](https://mysites.guru/vulnerabilities/CVE-2026-77027/)[CVE-2026-77992](https://mysites.guru/vulnerabilities/CVE-2026-77992/)[CVE-2026-76599](https://mysites.guru/vulnerabilities/CVE-2026-76599/)2026-08-22

### Fabrik (com\_fabrik) 4.7.0 and 4.7.1 - Unauthenticated Remote Code Execution risk, update to 4.7.2

Fabrik (the Joomla form and list builder by Fabrikar) shipped a series of security releases across the 4.7.x line. 4.7.2 is the release mySites.guru has verified, and 4.7.0 and 4.7.1 are missing part of that work. The calc element in this component carried a published unauthenticated remote code execution vulnerability (CVE-2026-66915 and CVE-2026-67282, both CVSS 10.0). mySites.guru worked with Fabrikar through the 4.7.x releases under coordinated disclosure, and 4.7.2 closes the issues raised. What to do: update Fabrik to 4.7.2, downloaded from fabrikar.com. Until you have, restrict front-end access to Fabrik forms and lists to trusted users. Sites below 4.7.0 are covered by a separate rule and remain exposed to the published CVSS 10.0 RCE.

Affected versions: ≥ 4.7.0 and < 4.7.2

Full advisory: [our disclosure post](https://mysites.guru/blog/fabrik-unauthenticated-rce-calc-element/)

High[CVE-2020-37219](https://mysites.guru/vulnerabilities/CVE-2020-37219/)[CVE-2026-67282](https://mysites.guru/vulnerabilities/CVE-2026-67282/)[CVE-2026-66915](https://mysites.guru/vulnerabilities/CVE-2026-66915/)2026-05-13

### Fabrik (com\_fabrik) below 4.7.0 - Unauthenticated Remote Code Execution (CVE-2026-66915 and CVE-2026-67282, both CVSS 10.0)

Fabrik has now shipped three security releases in five days, and 4.7.0 is the version to be on. Both published flaws are unauthenticated remote code execution, both scored CVSS 4.0 10.0 Critical, and both are CWE-94 code injection. CVE-2026-66915 is in the calc element plugin: the calc element evaluates a PHP expression to compute a field value, and its AJAX recalculation feature (ajax\_calc) could be reached by an anonymous visitor with no login and no user interaction. Fabrik 4.6.7 (9 August 2026) was released to fix it. That fix was incomplete. On 12 August 2026 the Joomla CNA revised the CVE record: the affected range was widened from 1.0.0-4.6.6 to 1.0.0-4.6.8, and the fixed version restated as 4.6.9. So 4.6.8 is still vulnerable to this flaw despite being the version the earlier advice pointed at. CVE-2026-67282 (published 12 August 2026, reported by Murad Gasimov) is the flaw behind the terse "Security fix for list filters" line in 4.6.8: an unauthenticated attacker could execute arbitrary code through the front end list filter model. Affected 1.0.0-4.6.7, fixed in 4.6.8. IMPORTANT: there is no public Fabrik 4.6.9. It is not on the vendor download listing, has no changelog entry, and its info page returns 404. The only publicly downloadable release that satisfies the revised CVE-2026-66915 ceiling is 4.7.0, released 13 August 2026 and described by the vendor as "a major hardening release against PHP eval attack vectors" and "a major security release". Update to 4.7.0. Upgrade notes from the vendor: 4.7.0 breaks any existing userAjax calls, and sites using the FullCalendar or Paypal plugins must update those to their current versions at the same time. Test on a staging copy first. Reach: Fabrik 4.x installs only on Joomla 4.2+ and Joomla 5.1+, and the vendor states Fabrik 4 will not install on Joomla 6. Downloading updates requires a valid Fabrik subscription. Joomla 3 sites: there is still no patched release on the Fabrik 3.x branch (last release 3.10, August 2021) and the vendor has confirmed there never will be, saying it does not own the F3 source repository and cannot publish releases to it. However, on 11 August 2026 a Fabrik administrator published a manual one-line source patch for F3 covering the calc element flaw only, in the Announcements forum: in plugin/fabrik\_element/calc/calc.php, add two true arguments to the parseMessageForPlaceHolder call. It is offered as-is with no warranty. The vendor states the second attack vector (the list filter one) does not affect F3. This is a partial, unsupported mitigation, not a fix, and the vendor strongly urges migration to Fabrik 4. Interim mitigation on any site that cannot update: unpublish public-facing Fabrik forms and lists. Also within this rule: CVE-2020-37219 (Fabrik 3.9.11), which sits below this ceiling and needs no separate row. Getting 4.7.0 is the hard part, and this is why your Joomla updater probably shows nothing. Fabrik left 4.7.0 out of its update feed at release and added it on 16 August 2026 tagged as a release candidate. Joomla's Minimum Extension Stability setting defaults to Stable and silently discards anything below that, so set it to Release Candidate under System > Update > Extensions > Options. Separately, the feed's targetplatform for both 4.7.0 and 4.6.8 is "5.\[4\]", which Joomla treats as a regular expression against the running Joomla version: it matches Joomla 5.4.x only, so on Joomla 4.2 through 5.3 neither is ever offered whatever the stability setting. On those sites the only route is a manual download from My Download Files on fabrikar.com, installed via Extensions > Install. On 16 August 2026 mySites.guru obtained the 4.7.0 package (SHA-256 matching the vendor's own update feed) and audited the source, which has never been published anywhere. Both flaws are properly fixed, and fixed structurally: eval() now appears in two files out of 869, and the helper compiles the site builder's code once and binds request data as PHP variables instead of substituting it into the code as text. We found no remaining route from an unauthenticated request to code execution. Note that the vendor relabelled 4.7.0 from Stable to Release Candidate on 16 August, on the same build. It is still the version to be on.

Affected versions: < 4.7.0

Full advisory: [our disclosure post](https://mysites.guru/blog/fabrik-unauthenticated-rce-calc-element/)

## Timeline

1.  13 May 2026Check added for CVE-2020-37219, CVE-2026-67282 and CVE-2026-66915 (before 4.7.0)
2.  13 May 2026[CVE-2020-37219 record published](https://mysites.guru/vulnerabilities/CVE-2020-37219/)
3.  10 August 2026[CVE-2026-66915 record published](https://mysites.guru/vulnerabilities/CVE-2026-66915/)
4.  10 August 2026[We published: The Fabrik Fiasco: Announced, Restricted, Relabelled](https://mysites.guru/blog/fabrik-unauthenticated-rce-calc-element/)
5.  12 August 2026[CVE-2026-67282 record published](https://mysites.guru/vulnerabilities/CVE-2026-67282/)
6.  22 August 2026Check added for CVE-2026-76571, CVE-2026-76596, CVE-2026-76597, CVE-2026-76598, CVE-2026-76600, CVE-2026-76601, CVE-2026-76602, CVE-2026-76603, CVE-2026-76604, CVE-2026-76605, CVE-2026-76606, CVE-2026-76607, CVE-2026-76608, CVE-2026-76609, CVE-2026-77027, CVE-2026-77992 and CVE-2026-76599 (from 4.7.0 up to but not including 4.7.2)
7.  22 August 2026[CVE-2026-76571 record published](https://mysites.guru/vulnerabilities/CVE-2026-76571/)
8.  22 August 2026[CVE-2026-76596 record published](https://mysites.guru/vulnerabilities/CVE-2026-76596/)
9.  22 August 2026[CVE-2026-76597 record published](https://mysites.guru/vulnerabilities/CVE-2026-76597/)
10.  22 August 2026[CVE-2026-76598 record published](https://mysites.guru/vulnerabilities/CVE-2026-76598/)
11.  22 August 2026[CVE-2026-76600 record published](https://mysites.guru/vulnerabilities/CVE-2026-76600/)
12.  22 August 2026[CVE-2026-76601 record published](https://mysites.guru/vulnerabilities/CVE-2026-76601/)
13.  22 August 2026[CVE-2026-76602 record published](https://mysites.guru/vulnerabilities/CVE-2026-76602/)
14.  22 August 2026[CVE-2026-76603 record published](https://mysites.guru/vulnerabilities/CVE-2026-76603/)
15.  22 August 2026[CVE-2026-76604 record published](https://mysites.guru/vulnerabilities/CVE-2026-76604/)
16.  22 August 2026[CVE-2026-76605 record published](https://mysites.guru/vulnerabilities/CVE-2026-76605/)
17.  22 August 2026[CVE-2026-76606 record published](https://mysites.guru/vulnerabilities/CVE-2026-76606/)
18.  22 August 2026[CVE-2026-76607 record published](https://mysites.guru/vulnerabilities/CVE-2026-76607/)
19.  22 August 2026[CVE-2026-76608 record published](https://mysites.guru/vulnerabilities/CVE-2026-76608/)
20.  22 August 2026[CVE-2026-76609 record published](https://mysites.guru/vulnerabilities/CVE-2026-76609/)
21.  22 August 2026[CVE-2026-77027 record published](https://mysites.guru/vulnerabilities/CVE-2026-77027/)
22.  22 August 2026[CVE-2026-77992 record published](https://mysites.guru/vulnerabilities/CVE-2026-77992/)
23.  22 August 2026[CVE-2026-76599 record published](https://mysites.guru/vulnerabilities/CVE-2026-76599/)
24.  22 August 2026[We published: Fabrik 4.7.2 for Joomla: A Long List of Security Fixes](https://mysites.guru/blog/fabrik-4-7-2-security-release/)

## What we have written about Fabrik

[![Fabrik 4.7.2 for Joomla: A Long List of Security Fixes](https://mysites.guru/_astro/fabrik-4-7-2-security-release.Buux8sYH_Z2atItR.webp)

### Fabrik 4.7.2 for Joomla: A Long List of Security Fixes

Fabrik 4.7.2 for the Joomla extension closes a long list of unauthenticated vulnerabilities, most of them found and reported by mySites.guru. Update now.

22 Aug 2026

](https://mysites.guru/blog/fabrik-4-7-2-security-release/)[![The Fabrik Fiasco: Announced, Restricted, Relabelled](https://mysites.guru/_astro/fabrik-unauthenticated-rce-calc-element.BBK044-m_AuNLM.webp)

### The Fabrik Fiasco: Announced, Restricted, Relabelled

Two CVSS 10.0 RCEs in the Fabrik Joomla extension, and a chaotic run of security releases since. The vendor has moved past 4.7.0; be on 4.7.2.

10 Aug 2026

](https://mysites.guru/blog/fabrik-unauthenticated-rce-calc-element/)

## References

-   [The Fabrik Fiasco: Announced, Restricted, Relabelled](https://mysites.guru/blog/fabrik-unauthenticated-rce-calc-element/)

Each CVE page above links its official cve.org record and its NVD entry.

## Fabrik vulnerability questions

Show all

Which versions of Fabrik are vulnerable?

mySites.guru tracks 2 vulnerabilities in Fabrik (com\_fabrik). A site is affected if its installed version is in any of these ranges: from 4.7.0 up to but not including 4.7.2; before 4.7.0.

What is the latest safe version of Fabrik?

4.7.2. Every vulnerability tracked here is fixed by 4.7.2, and no rule we check matches that release or any later one.

How do I check which version of Fabrik my Joomla site runs?

The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com\_fabrik. mySites.guru reads the installed version on every audit of a connected site and checks it against these rules.

## Running Fabrik on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day.

This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/).

CVE identifiers: [CVE-2026-76571](https://mysites.guru/vulnerabilities/CVE-2026-76571/), [CVE-2026-76596](https://mysites.guru/vulnerabilities/CVE-2026-76596/), [CVE-2026-76597](https://mysites.guru/vulnerabilities/CVE-2026-76597/), [CVE-2026-76598](https://mysites.guru/vulnerabilities/CVE-2026-76598/), [CVE-2026-76600](https://mysites.guru/vulnerabilities/CVE-2026-76600/), [CVE-2026-76601](https://mysites.guru/vulnerabilities/CVE-2026-76601/), [CVE-2026-76602](https://mysites.guru/vulnerabilities/CVE-2026-76602/), [CVE-2026-76603](https://mysites.guru/vulnerabilities/CVE-2026-76603/), [CVE-2026-76604](https://mysites.guru/vulnerabilities/CVE-2026-76604/), [CVE-2026-76605](https://mysites.guru/vulnerabilities/CVE-2026-76605/), [CVE-2026-76606](https://mysites.guru/vulnerabilities/CVE-2026-76606/), [CVE-2026-76607](https://mysites.guru/vulnerabilities/CVE-2026-76607/), [CVE-2026-76608](https://mysites.guru/vulnerabilities/CVE-2026-76608/), [CVE-2026-76609](https://mysites.guru/vulnerabilities/CVE-2026-76609/), [CVE-2026-77027](https://mysites.guru/vulnerabilities/CVE-2026-77027/), [CVE-2026-77992](https://mysites.guru/vulnerabilities/CVE-2026-77992/), [CVE-2026-76599](https://mysites.guru/vulnerabilities/CVE-2026-76599/), [CVE-2020-37219](https://mysites.guru/vulnerabilities/CVE-2020-37219/), [CVE-2026-67282](https://mysites.guru/vulnerabilities/CVE-2026-67282/), [CVE-2026-66915](https://mysites.guru/vulnerabilities/CVE-2026-66915/). Rules current as of 14 October 2026.