CVE-2026-76604: Fabrik Joomla Extension RCE Vulnerability

CVE-2026-76604 Overview

CVE-2026-76604 is an unauthenticated remote code execution vulnerability in the Fabrik extension for Joomla, developed by fabrikar.com. The flaw affects Fabrik versions prior to 4.7.2. The PHP form element in Fabrik executes user-supplied code without proper validation. Remote attackers can send crafted requests to trigger arbitrary PHP execution on the underlying web server. The vulnerability maps to [CWE-94] Improper Control of Generation of Code (Code Injection). Successful exploitation grants attackers full control of the affected Joomla installation and its host.

Critical Impact
Unauthenticated attackers can execute arbitrary PHP code on Joomla sites running Fabrik versions earlier than 4.7.2, leading to complete site and server compromise.

Affected Products

Fabrik extension for Joomla, versions prior to 4.7.2
Joomla installations using the Fabrik PHP form element
Web servers hosting vulnerable Fabrik deployments

Discovery Timeline

2026-08-22 - CVE-2026-76604 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-76604

Vulnerability Analysis

Fabrik is a Joomla extension used to build data-driven forms, lists, and applications. The extension exposes a PHP form element that accepts and evaluates PHP expressions supplied through form input. Because the element does not restrict who can submit code or sanitize the input, remote attackers can inject arbitrary PHP statements. The evaluated code runs with the privileges of the PHP process serving Joomla. Attackers gain the ability to read files, write webshells, pivot into internal networks, and manipulate the Joomla database. This is categorized as unauthenticated remote code execution.

Root Cause

The root cause is direct evaluation of attacker-controlled input by the PHP form element in Fabrik. The extension treats user-provided content as trusted PHP source and passes it to a code-execution primitive such as eval() or an equivalent construct. No authentication check, allowlist, or sandbox restricts the evaluation. This design fits [CWE-94] Code Injection.

Attack Vector

An attacker submits a crafted HTTP request to a Fabrik form that includes a PHP form element. The payload is embedded in a field the element evaluates server-side. No credentials are required. Because Fabrik runs inside Joomla, execution occurs in the web application context and can lead to webshell deployment, credential theft from configuration.php, and lateral movement.

No verified public exploit code is available. See the Fabrikar project at
https://www.fabrikar.com/ for vendor guidance and release notes.

Detection Methods for CVE-2026-76604

Indicators of Compromise

Unexpected PHP files written to Joomla directories such as /components/, /media/, or /tmp
Outbound network connections from the web server to unfamiliar hosts following Fabrik form submissions
Web server processes spawning shells (sh, bash, cmd.exe) or system utilities like curl, wget, or python
POST requests to Fabrik form endpoints containing PHP tokens such as <?php, system(, passthru(, or base64_decode(

Detection Strategies

Inspect web server access logs for POST requests to Fabrik form URLs that contain PHP function names or encoded payloads
Correlate Fabrik form submissions with new child processes of the PHP-FPM or Apache worker
Monitor file integrity on the Joomla web root and flag new or modified .php files

Monitoring Recommendations

Enable audit logging on the Joomla administrator console and Fabrik configuration changes
Forward web, application, and host telemetry to a central data lake for correlation across Fabrik form activity and process execution
Alert on outbound egress from the web tier to non-approved destinations

How to Mitigate CVE-2026-76604

Immediate Actions Required

Upgrade Fabrik to version 4.7.2 or later on every Joomla instance
Audit all Fabrik forms and remove PHP form elements that accept user input where they are not strictly required
Review the Joomla web root and database for webshells, unauthorized administrator accounts, and modified extensions
Rotate Joomla administrator credentials and any secrets stored in configuration.php

Patch Information

Update to Fabrik 4.7.2 or newer. Refer to the Fabrikar Official Website for release details and download links. Apply the patch across development, staging, and production Joomla environments.

Workarounds

Disable the Fabrik PHP form element until the upgrade is applied
Restrict access to Fabrik form endpoints using web application firewall rules that block PHP tokens in request bodies
Place the Joomla site behind authentication or IP allowlisting during remediation

bash

# Example WAF rule concept: block PHP tokens in Fabrik form POST bodies
# ModSecurity pseudo-rule
SecRule REQUEST_URI "@contains /index.php" \
  "chain,deny,status:403,id:1026766040,msg:'Fabrik CVE-2026-76604 payload blocked'"
  SecRule REQUEST_BODY "@rx (?i)(<\?php|system\(|passthru\(|base64_decode\()"