CVE-2026-76598: Joomla Fabrik Path Traversal Vulnerability

CVE-2026-76598 Overview

CVE-2026-76598 is a path traversal vulnerability [CWE-22] in the Fabrik extension for Joomla, developed by fabrikar.com. The flaw exists in the onAjax_getFolders method of the elements model. An unauthenticated remote attacker can invoke this AJAX endpoint to enumerate arbitrary directories on the underlying server. The issue affects Fabrik versions prior to 4.7.2. Successful exploitation exposes internal filesystem structure, which supports reconnaissance for follow-on attacks against the Joomla host.

Critical Impact
Unauthenticated attackers can enumerate arbitrary server directories on Joomla sites running vulnerable Fabrik releases, exposing sensitive filesystem layout without any credentials.

Affected Products

Fabrik extension for Joomla, all versions prior to 4.7.2
Joomla sites with the Fabrik component installed and enabled
Publisher: fabrikar.com

Discovery Timeline

2026-08-22 - CVE-2026-76598 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-76598

Vulnerability Analysis

Fabrik is a Joomla extension that builds data-driven applications, forms, and lists. It exposes an AJAX-driven elements model that Joomla dispatches through the standard index.php?option=com_fabrik&task=... router. The onAjax_getFolders handler returns a listing of folders under a caller-supplied path. In versions before 4.7.2, the handler does not require authentication and does not constrain the requested path to an allowlisted base directory.

An attacker sends a crafted HTTP request that invokes onAjax_getFolders with a path parameter pointing at any location the web server user can read. The endpoint returns the enumerated folder names in the response, leaking filesystem structure that would normally be restricted to administrators.

Root Cause

The root cause is missing access control and missing path canonicalization on the onAjax_getFolders entry point. The method treats the caller-controlled directory argument as trusted input. It performs no session or capability check to confirm the requester is a privileged Joomla user, and it does not verify that the resolved path stays within an intended base directory. This combination is a classic path traversal condition tracked under CWE-22.

Attack Vector

Exploitation occurs over the network against the public Joomla front controller. The attacker does not need credentials, tokens, or user interaction. A single HTTP GET or POST request to the Fabrik AJAX task is sufficient to retrieve directory contents. Repeated requests, iterating through parent directories with sequences such as ../, allow the attacker to map webroot, configuration directories, backup locations, and other sensitive paths on the server. The vulnerability affects confidentiality only; the endpoint does not modify or delete data.

No verified public proof-of-concept code is referenced in the advisory. See the Fabrikar official website for vendor guidance.

Detection Methods for CVE-2026-76598

Indicators of Compromise

Web server access logs containing requests to index.php with option=com_fabrik and a task or method referencing onAjax_getFolders.
Requests to Fabrik AJAX endpoints from unauthenticated sessions or unfamiliar IP addresses, especially in high-volume bursts.
Path parameters in query strings or POST bodies containing ../ sequences, absolute paths such as /etc, or references to configuration.php.

Detection Strategies

Enable verbose access logging on the Joomla web server and alert on any invocation of onAjax_getFolders that lacks an authenticated administrator session cookie.
Deploy a web application firewall rule that inspects com_fabrik traffic for directory traversal patterns and blocks requests containing ../ or absolute filesystem paths.
Correlate Fabrik AJAX requests with subsequent access attempts to sensitive files, which often indicates reconnaissance progressing toward exploitation.

Monitoring Recommendations

Inventory all Joomla instances and record the installed Fabrik version; flag any host running below 4.7.2.
Monitor for spikes in 200-response Fabrik AJAX traffic from single source addresses, which suggests automated directory enumeration.
Track outbound anomalies from Joomla hosts after suspected reconnaissance, since attackers commonly pivot from information disclosure to file inclusion or credential theft.

How to Mitigate CVE-2026-76598

Immediate Actions Required

Upgrade the Fabrik extension to version 4.7.2 or later on every Joomla site where it is installed.
Audit web server access logs for prior invocations of onAjax_getFolders and treat any successful unauthenticated call as a reconnaissance event.
Restrict administrative and AJAX endpoints of com_fabrik to authenticated users at the web server or reverse proxy layer until the patch is applied.

Patch Information

The vendor addresses this vulnerability in Fabrik 4.7.2. Administrators should download the fixed release from the Fabrikar official website and apply it through the Joomla extension manager. After upgrading, verify the installed version in the Joomla administrator console and confirm that requests to onAjax_getFolders from unauthenticated sessions are rejected.

Workarounds

Disable the Fabrik component in the Joomla extension manager until the upgrade to 4.7.2 is completed.
Add a web application firewall rule that blocks HTTP requests targeting option=com_fabrik combined with onAjax_getFolders from unauthenticated clients.
Restrict access to the Joomla index.php endpoint by source IP for administrative networks where feasible, reducing exposure of Fabrik AJAX handlers to the public internet.

bash

# Example WAF rule (ModSecurity) blocking unauthenticated Fabrik folder enumeration
SecRule REQUEST_URI "@rx (?i)option=com_fabrik" \
    "chain,phase:2,deny,status:403,id:2026076598,\
    msg:'Block Fabrik onAjax_getFolders directory listing (CVE-2026-76598)'"
    SecRule ARGS|REQUEST_BODY "@rx (?i)onAjax_getFolders" \
        "chain"
        SecRule &REQUEST_COOKIES:/^[0-9a-f]{32}$/ "@eq 0"