CVE-2026-66915

CriticalCVSS 10.0

Published: 10/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Summary

A remote code execution vulnerability in the Fabrik extension for Joomla (versions < 4.6.7) allows an unauthenticated attacker to execute arbitrary code by using the ajax_calc feature of the calc plugin.

Risk Assessment

An unauthenticated attacker can take over the server, potentially leading to full system and data compromise.

Recommendation

Update the Fabrik extension to version 4.6.7 or later. If not possible, consider temporarily disabling the calc plugin.

Original NVD description (English source)

Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.6.7 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the calc plugin.