Executive brief
Fabrik is a Joomla component that allows site builders to create custom applications, forms, and data-backed lists without coding. The calc element evaluates PHP expressions to compute field values. An unauthenticated attacker can trigger arbitrary PHP code execution through the calc element's AJAX endpoint, compromising server security and enabling full system takeover.
Technical details
The vulnerability exists in the calc element of Fabrik, which evaluates PHP expressions defined by site builders. The AJAX recalculation endpoint in com_fabrik is reachable by any anonymous visitor without authentication or user interaction, allowing direct invocation of the calc element's code evaluation logic. By sending a crafted AJAX request to trigger recalculation, an attacker can execute arbitrary PHP code on the server with the privileges of the web server process. The root cause is improper access control on the AJAX endpoint combined with unsafe evaluation of user-controlled PHP expressions. Versions 1.0.0 through 4.6.8 are affected; the fix was attempted in 4.6.7 but failed and was re-addressed in 4.7.0 and later.
Affected products
- Fabrik Fabrik 1.0.0 to 4.6.8
Timeline
- 2026-08-10: disclosed: CVE-2026-66915 published affecting versions 1.0.0 to 4.6.6, claimed fixed in 4.6.7
- 2026-08-12: advisory: CVE-2026-66915 revised to include 4.6.7 and 4.6.8 as affected; claimed fix moved to 4.6.9 (never publicly released)
- 2026-08-13: patched: Fabrik 4.7.0 released as security hardening release addressing the vulnerability