CVE-2026-77992 is a critical vulnerability in the Fabrik extension for Joomla, affecting versions 1.0.0 to 4.7.1. The issue arises from improper control of code generation (CWE-94), specifically a heredoc terminator breakout in the calc element. Additionally, the onUpdateComment endpoint does not perform any access checks, which could be exploited to inject and execute arbitrary code. The vulnerability has a CVSS 4.0 base score of 9.5, indicating high exploitability and impact. No official patch or remediation guidance has been published by the vendor as of the data provided.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary code on the affected system due to the lack of access control on the onUpdateComment endpoint and the code injection flaw in the calc element. This could lead to full compromise of the Joomla installation running the vulnerable Fabrik extension.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoints and monitor for suspicious activity related to the onUpdateComment endpoint. Avoid exposing the Fabrik extension to untrusted users.