CVE Catalog
CVE-2026-76604
CriticalCVSS 10.0Summary
The Joomla extension Fabrik before version 4.7.3 contains an unauthenticated remote code execution vulnerability in the PHP form element. The element is vulnerable to execution of user-provided code.
Risk Assessment
An unauthenticated attacker can execute arbitrary PHP code on the server, potentially leading to full system compromise.
Recommendation
Update Fabrik to version 4.7.3 or later to fix the vulnerability.
Original NVD description (English source)
Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.3 - The PHP form element is vulnerable to the execution of user provided codes.