Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-76606: Fabrik extension for Joomla can let attackers read any file
CVE-2026-76606 · published 12 days ago
Summary
Websites that use the Fabrik add‑on for Joomla, version older than 4.7.3, are vulnerable. An attacker can craft a special image request that makes the server open files outside the intended folder, potentially exposing sensitive data. Update the Fabrik extension to version 4.7.3 or later, and apply any available security patches.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fabrikar.com | fabrik extension for joomla |
1.0.0-4.7.3 1.0.0-4.7.1 |
Original advisory text
Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.
Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.
References
- https://www.fabrikar.com/ product
Severity
10.0
Critical
Exploitation
EPSS <1%
Type
CWE-22Path Traversal
Timeline
Published22 Aug 2026
Updated30 Aug 2026
First seen22 Aug 2026
Monitor software like this
Free during beta