CVE-2026-76606: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in fabrikar.com Fabrik extension for Joomla

This vulnerability (CWE-22) affects the Fabrik extension for Joomla, specifically versions up to and including 4.7.3. It involves improper limitation of a pathname to a restricted directory via the image element, enabling path traversal attacks. The flaw allows an unauthenticated attacker to access files outside the intended directory scope, potentially exposing sensitive information or enabling further exploitation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, availability, and security requirements. No patch or official remediation level has been disclosed as of the publication date.

An attacker can exploit this vulnerability remotely without authentication or user interaction to traverse directories and access files outside the intended scope. This can lead to unauthorized disclosure of sensitive information, potential modification or deletion of files, and compromise of system integrity and availability. The critical CVSS score reflects the high severity and broad impact of this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected Joomla extension or disabling the image element functionality in Fabrik if feasible. Monitor official vendor channels for updates and apply patches promptly once available.