CVE-2026-66915 Overview
CVE-2026-66915 is an unauthenticated remote code execution vulnerability in the Fabrik extension for Joomla, developed by fabrikar.com. The flaw affects Fabrik versions prior to 4.6.9 and resides in the ajax_calc feature of the calc plugin. An unauthenticated attacker can send crafted requests to the vulnerable endpoint and execute arbitrary code on the underlying server. The issue is categorized as improper control of code generation [CWE-94]. Fabrik is a widely deployed Joomla application builder used to create forms, lists, and data-driven components, which broadens the exposure surface for affected sites.
Critical Impact
Unauthenticated attackers can execute arbitrary code on Joomla sites running Fabrik prior to 4.6.9, leading to full site and server compromise.
Affected Products
- Fabrik extension for Joomla, versions prior to 4.6.9
- Joomla installations using the Fabrik calc plugin
- fabrikar.com Fabrik component with the ajax_calc feature enabled
Discovery Timeline
- 2026-08-10 - CVE-2026-66915 published to the National Vulnerability Database (NVD)
- 2026-08-12 - Last updated in NVD database
- 2026-08-14 - EPSS score published at 0.6% (percentile 45.7)
Technical Details for CVE-2026-66915
Vulnerability Analysis
The vulnerability resides in the Fabrik calc element, which allows administrators to define PHP-style calculation expressions used to compute values within forms and lists. The ajax_calc feature exposes this evaluation logic through an AJAX endpoint reachable without authentication. Because the endpoint accepts attacker-controlled input that is passed into a code-evaluation routine, arbitrary PHP code can be executed in the context of the web server process. Successful exploitation grants attackers the same privileges as the Joomla application, enabling webshell deployment, credential theft from configuration.php, database manipulation, and lateral movement within the hosting environment. See the MySites Guru technical write-up for a detailed walkthrough.
Root Cause
The root cause is improper control of generation of code [CWE-94]. Fabrik passes untrusted request parameters supplied to the ajax_calc endpoint into a dynamic PHP evaluation path without adequate validation, sanitization, or authentication checks. The calc plugin was designed to evaluate site-defined expressions, but exposing this evaluation surface to unauthenticated HTTP requests eliminates the trust boundary and turns a feature into an execution primitive.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to the Joomla site targeting the Fabrik component with the ajax_calc task and supplies a crafted calculation payload. The server evaluates the payload as PHP, returning the result of the attacker-controlled expression. Refer to the Fabrikar vendor site for product context and to the MySites Guru advisory for exploitation details.
Detection Methods for CVE-2026-66915
Indicators of Compromise
- HTTP requests to Joomla URLs containing option=com_fabrik combined with the ajax_calc task or view parameter
- Unexpected PHP files, webshells, or modified files within the Joomla images/, tmp/, or Fabrik component directories
- Outbound connections from the web server to unfamiliar hosts shortly after Fabrik-related requests
- New or modified Joomla administrator accounts and unauthorized changes to configuration.php
Detection Strategies
- Review web server access logs for POST or GET requests to Fabrik endpoints referencing ajax_calc, calc, or element_calc
- Alert on php, system, exec, passthru, or base64_decode strings appearing in query parameters or POST bodies sent to com_fabrik
- Correlate Fabrik requests with process telemetry showing php-fpm or Apache spawning shell interpreters such as sh, bash, or cmd.exe
Monitoring Recommendations
- Enable file integrity monitoring on Joomla web roots and the Fabrik component directory
- Forward web server, PHP error, and EDR process telemetry to a central SIEM for correlation across the exploitation chain
- Track EPSS trends for CVE-2026-66915 to prioritize response as exploitation likelihood evolves
How to Mitigate CVE-2026-66915
Immediate Actions Required
- Upgrade Fabrik to version 4.6.9 or later on all Joomla installations
- Audit the Joomla site for webshells, unauthorized administrator accounts, and modified core files following patching
- Rotate database credentials, Joomla admin passwords, and API keys stored in configuration.php if compromise is suspected
Patch Information
Fabrikar has released Fabrik 4.6.9, which remediates the unauthenticated RCE in the ajax_calc handler of the calc plugin. Administrators should download the fixed release from the Fabrikar homepage and apply it through the Joomla Extension Manager. After upgrading, verify the installed version in the Joomla administrator interface and confirm that any custom calc elements continue to function as expected.
Workarounds
- Temporarily disable the Fabrik component in Joomla until the 4.6.9 update can be applied
- Block requests to com_fabrik URLs containing the ajax_calc task at the web application firewall (WAF) or reverse proxy
- Restrict access to Joomla administration and Fabrik endpoints by source IP where operationally feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
