The Fabrik extension for Joomla contains a path traversal vulnerability (CWE-22) in versions 1.0.0 through 4.7.3. This vulnerability arises from improper limitation of a pathname to a restricted directory via the image element, potentially allowing attackers to access files outside the intended directory scope. The CVSS 4.0 base score is 10.0, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker can exploit this vulnerability remotely without authentication or user interaction to perform path traversal attacks. This can lead to unauthorized access to sensitive files and data outside the intended directory, potentially compromising confidentiality, integrity, and availability of the affected system. Given the CVSS score of 10.0, the impact is critical.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the Fabrik extension or disabling the vulnerable image element functionality if possible. Monitor official Joomla and Fabrik extension channels for updates.