CVE-2026-76598CWE-22CWE-284path-traversalbroken-access-control

CVE-2026-76598

published August 22, 2026

CVSS

8.7

EPSS

Percentile

39.3

In the wild

Unconfirmed

What it is

Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the elements model allows arbitrary directory listings.

The record

Technical detail

CVSS: 8.7 · NONE
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00465 · 39.3th percentile
Weaknesses: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-284 · Improper Access Control
Published: 2026-08-22T19:16Z

References (1)

https://www.fabrikar.com/ · [email protected]

EPSS history

Timeline

22 AUG 14:20Z
Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2
cvelistv5