CVE-2026-76597 - Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2

Back Back to CVE browser

HIGH

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2

Published Aug 22, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.44%

Description

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot.

Affected products

Vendor Fabrikar.com Product Fabrik extension for Joomla Default
unaffected
- Version
  1.0.0-4.7.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Fabrikar.com

Fabrik extension for Joomla

unaffected

Version	Status	Constraints
1.0.0-4.7.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-284

References (1)

https://www.fabrikar.com/
product

Link	Providers	Tags
https://www.fabrikar.com/		product

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Joomla

Published Aug 22, 2026

Updated Aug 24, 2026

Reserved Aug 19, 2026

Link CVE-2026-76597

CISA Vulnrichment

Updated Aug 24, 2026

NVD

Status Deferred

Modified Aug 26, 2026

Link CVE-2026-76597

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-76597