The Fabrik extension for Joomla contains an improper access control vulnerability (CWE-284) combined with directory traversal issues (CWE-22) in the onAjax_getFolders method of its elements model. This flaw allows unauthenticated users to list arbitrary directories on the server, potentially exposing sensitive information. The vulnerability affects all versions from 1.0.0 up to and including 4.7.1. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

An unauthenticated attacker can leverage this vulnerability to perform arbitrary directory listings on the affected server, potentially exposing sensitive files and directory structures. This can lead to information disclosure that may facilitate further attacks or reconnaissance. The vulnerability does not require any privileges or user interaction, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected Joomla extension or disabling the onAjax_getFolders functionality if possible to reduce exposure.