CVE-2020-37219: Joomla com_fabrik Path Traversal Flaw

CVE-2020-37219 Overview

CVE-2020-37219 is a directory traversal vulnerability [CWE-22] in the Joomla com_fabrik 3.9.11 extension. Unauthenticated remote attackers can list arbitrary files outside the web root by sending crafted GET requests to the onAjax_files method. The exploit manipulates the folder parameter with path traversal sequences such as ../ to enumerate sensitive system directories. Successful exploitation exposes server filesystem contents without requiring authentication or user interaction. A public proof-of-concept exists on Exploit-DB, increasing the operational risk for Joomla sites running this extension.

Critical Impact

Unauthenticated attackers can enumerate arbitrary filesystem paths on Joomla servers running com_fabrik 3.9.11, exposing configuration files and other sensitive content.

Affected Products

• Joomla com_fabrik extension version 3.9.11
• Joomla CMS installations with the Fabrik component installed
• Web servers hosting vulnerable Fabrik AJAX file handlers

Discovery Timeline

• 2026-05-13 - CVE-2020-37219 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2020-37219

Vulnerability Analysis

The vulnerability resides in the Fabrik component's AJAX endpoint that handles file listing operations. The onAjax_files method accepts a folder parameter from the HTTP request and uses it to enumerate directory contents. The component fails to canonicalize or validate this parameter against an allowed base directory. Attackers supply path traversal sequences to escape the intended directory and walk the server filesystem.

Because the endpoint does not require authentication, any remote client able to reach the Joomla site can issue the request. The response discloses the names of files in the traversed directory, enabling reconnaissance of system layout, configuration files, and credentials referenced by other components. The disclosure scope is limited to file enumeration rather than full content read, but it provides strong staging information for follow-on attacks.

Root Cause

The root cause is missing input validation on the folder parameter consumed by the onAjax_files AJAX handler. The handler concatenates user-controlled input into a filesystem path without restricting traversal characters or enforcing a chroot-style base directory. This pattern matches [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker issues a GET request to the Fabrik AJAX route invoking onAjax_files, supplying a folder value containing ../ sequences to reach directories outside the intended Fabrik upload area. The vulnerability mechanism is documented in Exploit-DB #48263 and the VulnCheck Joomla Advisory. No exploitation code is reproduced here; refer to the upstream advisories for technical specifics.

Detection Methods for CVE-2020-37219

Indicators of Compromise

• HTTP GET requests to Fabrik AJAX endpoints containing onAjax_files in the query string
• Requests where the folder parameter contains ../, ..%2f, or other encoded traversal sequences
• Repeated enumeration requests from a single source IP targeting Fabrik routes

Detection Strategies

• Inspect web server access logs for query strings combining com_fabrik, onAjax_files, and traversal patterns in the folder parameter.
• Deploy WAF signatures that flag path traversal payloads against Joomla component routes.
• Correlate Fabrik request volume against baselines to surface scripted enumeration activity.

Monitoring Recommendations

• Forward Joomla and reverse proxy logs to a centralized analytics platform for query string inspection.
• Alert on 200-OK responses to Fabrik AJAX requests carrying suspicious folder values.
• Monitor outbound connections from web servers for anomalous follow-on activity after suspected enumeration.

How to Mitigate CVE-2020-37219

Immediate Actions Required

• Identify all Joomla sites running the Fabrik component and confirm the installed version.
• Disable or unpublish com_fabrik on hosts running version 3.9.11 until a fixed release is applied.
• Block external access to Fabrik AJAX routes at the WAF or reverse proxy where the component is not required.

Patch Information

Upgrade to a fixed Fabrik release published by the vendor. Refer to the Fabrikar Downloads Section and the Fabrikar Official Site for current releases and release notes. Validate that the deployed component version is later than 3.9.11 after upgrade.

Workarounds

• Restrict access to /index.php?option=com_fabrik AJAX endpoints using web server ACLs where Fabrik is not publicly required.
• Add WAF rules that reject requests where the folder parameter contains traversal sequences such as ../ or URL-encoded equivalents.
• Apply least-privilege filesystem permissions to the web server user so traversal exposes minimal sensitive content.