# CVE-2026-66915: Fabrik calc element remote code execution via AJAX

Source: https://junglewise.ai/threats/cve-2026-66915-fabrik-calc-element-remote-code-execution-via-ajax  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-66915 · Severity: info · CVSS 10 · Published 2026-08-10

Fabrik is a Joomla component that allows site builders to create custom applications, forms, and data-backed lists without coding. The calc element evaluates PHP expressions to compute field values. An unauthenticated attacker can trigger arbitrary PHP code execution through the calc element's AJAX endpoint, compromising server security and enabling full system takeover.

Technologies: [Fabrik](https://junglewise.ai/threats/technologies/fabrik). Vendors: [Fabrik](https://junglewise.ai/threats/vendors/fabrik).

## Quick answers

**Is CVE-2026-66915 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66915 being exploited in the wild.

**How severe is CVE-2026-66915?** Informational severity, with a CVSS score of 10, published 10 August 2026.

**Which products and versions are affected?** Fabrik 1.0.0 to 4.6.8.

**Is there a fix for CVE-2026-66915?** A patch was published on 2026-08-13: Fabrik 4.7.0 released as security hardening release addressing the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66915 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-66915?** Check whether you run Fabrik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the calc element of Fabrik, which evaluates PHP expressions defined by site builders. The AJAX recalculation endpoint in com_fabrik is reachable by any anonymous visitor without authentication or user interaction, allowing direct invocation of the calc element's code evaluation logic. By sending a crafted AJAX request to trigger recalculation, an attacker can execute arbitrary PHP code on the server with the privileges of the web server process. The root cause is improper access control on the AJAX endpoint combined with unsafe evaluation of user-controlled PHP expressions. Versions 1.0.0 through 4.6.8 are affected; the fix was attempted in 4.6.7 but failed and was re-addressed in 4.7.0 and later.

## Affected products

- Fabrik Fabrik 1.0.0 to 4.6.8

## Timeline

- 2026-08-10: disclosed: CVE-2026-66915 published affecting versions 1.0.0 to 4.6.6, claimed fixed in 4.6.7
- 2026-08-12: advisory: CVE-2026-66915 revised to include 4.6.7 and 4.6.8 as affected; claimed fix moved to 4.6.9 (never publicly released)
- 2026-08-13: patched: Fabrik 4.7.0 released as security hardening release addressing the vulnerability

## References

- [https://www.fabrikar.com/](https://www.fabrikar.com/)
- [https://mysites.guru/blog/fabrik-unauthenticated-rce-calc-element/](https://mysites.guru/blog/fabrik-unauthenticated-rce-calc-element/)

## Related threats

- [Fabrik unauthenticated stored XSS in jsactions feature](https://junglewise.ai/threats/cve-2026-77027-fabrik-unauthenticated-stored-xss-in-jsactions-feature)
- [Fabrik unauthenticated comment modification](https://junglewise.ai/threats/cve-2026-76609-fabrik-unauthenticated-comment-modification)
- [Fabrik unauthenticated email disclosure in onGetEmail endpoint](https://junglewise.ai/threats/cve-2026-76608-fabrik-unauthenticated-email-disclosure-in-ongetemail-endpoint)
- [Joomla Fabrik download element missing ACL check](https://junglewise.ai/threats/cve-2026-76607-joomla-fabrik-download-element-missing-acl-check)
- [Fabrik unauthenticated row disclosure in form.inlineedit](https://junglewise.ai/threats/cve-2026-76603-fabrik-unauthenticated-row-disclosure-in-form-inlineedit)