The vulnerability in Joomla's com_fabrik 3.9.11 allows an attacker without authentication to request the image.php endpoint and manipulate the folder parameter to perform path traversal. By sending GET requests with .. sequences to the onAjax_files method, the attacker can list and access arbitrary files located outside the intended web root. This can lead to the disclosure of sensitive configuration files, database dumps, or other confidential data stored on the server, resulting in an information‑disclosure risk.

The affected product is Fabrikar's com_fabrik component for Joomla, specifically version 3.9.11. The vulnerability arises from the image.php script within that component. No other versions are listed as vulnerable in the provided data.

The CVSS score for this vulnerability is 8.7, indicating a high severity. The EPSS score is not available, and the vulnerability is not currently listed in CISA's KEV catalog. The likely attack vector is remote via the web, as attackers can trigger the flaw by sending unauthenticated HTTP GET requests to the vulnerable endpoint from any location with network access to the affected Joomla installation. Exploitation requires only the ability to send crafted requests, making it straightforward for attackers to enumerate files on the affected server.