CVE-2026-76605: CWE-94 Improper Control of Generation of Code ('Code Injection') in fabrikar.com Fabrik extension for Joomla

CVE-2026-76605 is a critical vulnerability in the Fabrik extension for Joomla, specifically versions 1.0.0 through 4.7.1. It involves improper control of code generation (CWE-94), enabling remote code execution through the image element. The vulnerability is publicly disclosed with a CVSS 4.0 score of 10, reflecting its high impact and ease of exploitation without privileges or user interaction. No vendor advisory or patch has been published yet, and the extension is not a cloud service, so remediation depends on vendor action or user updates.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on affected Joomla installations using the Fabrik extension. This can lead to full system compromise, data theft, or service disruption. The vulnerability affects all users running Fabrik versions from 1.0.0 up to and including 4.7.1. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Fabrik extension or restricting access to affected Joomla components to trusted administrators only. Monitor official Fabrik and Joomla channels for updates.