CVE-2026-77992: CWE-94 Improper Control of Generation of Code ('Code Injection') in fabrikar.com Fabrik extension for Joomla

This vulnerability (CWE-94) affects the Fabrik extension for Joomla, specifically versions from 1.0.0 up to and including 4.7.1. It arises from a heredoc terminator breakout in the calc element and the absence of access control on the onUpdateComment endpoint. These issues enable an attacker to perform code injection by improperly controlling code generation within the extension. The CVSS 4.0 base score is 9.5, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements.

Successful exploitation could allow an unauthenticated attacker to inject and execute arbitrary code within the context of the Joomla Fabrik extension, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor the fabrikar.com and Joomla advisories for updates and apply patches once available.