Executive brief
Fabrik is a Joomla extension for building custom web applications without programming knowledge. A vulnerability in versions before 4.7.2 allows attackers to execute arbitrary code through a heredoc terminator breakout in the calc element, combined with missing access controls on the onUpdateComment endpoint. This could result in complete compromise of the website and any data it manages.
Technical details
The vulnerability is a heredoc terminator breakout in the calc element of Fabrik, paired with insufficient access controls on the onUpdateComment endpoint. The calc element processes mathematical expressions using PHP heredoc syntax, and a specially crafted payload can break out of the heredoc terminator, allowing arbitrary PHP code injection. The onUpdateComment endpoint fails to perform authorization checks, allowing unauthenticated or low-privileged attackers to trigger the vulnerable code path. No network-based authentication is required if the endpoint is accessible. A successful exploit results in remote code execution with the privileges of the web server process. Fixed in Fabrik version 4.7.2 and later.
Affected products
- fabrikar.com Fabrik before 4.7.2
Timeline
- 2026-08-22: disclosed