The Fabrik extension for Joomla version 4.7.2 or earlier contains an unauthenticated arbitrary file upload flaw in the list email plugin controller. The flaw allows an attacker to upload any non‑executable file to the webroot without authentication. While the upload accepts only non‑executable files, a malicious user could still upload a script or other executable code in disguise or rely on server configuration that treats the upload as executable, leading to potential remote code execution or data exfiltration. This vulnerability can be leveraged by an attacker to store malicious files on the affected server, from which further attacks such as privilege escalation, data theft, or denial of service could be performed. The weakness is a classic example of improper access control (CWE‑284). Based on the description, it is inferred that malicious actors could attempt to disguise executable payloads as non‑executable files, increasing the risk of remote code execution depending on server configuration. It is also inferred that the stored malicious files might serve as footholds for further attacks including privilege escalation or data exfiltration.

Affecting the Fabrikar.com Fabrik extension for Joomla. All releases of the extension prior to version 4.7.2 are impacted. No specific patch version is provided, but the recommendation is to apply any update that moves the package beyond 4.7.2.

The CVSS score of 8.7 classifies this issue as high severity, reflecting an unauthenticated, remote attack path. Because the exploit does not require authentication and can be carried out over HTTP, the likelihood of exploitation is elevated in environments where the Joomla site is publicly reachable and the plugin is enabled. EPSS data are not available, and the vulnerability is not listed in CISA KEV. The absolute lack of authentication allows an attacker to simply send a crafted HTTP request to the list email plugin endpoint and cause a file upload to the web root, potentially leading to remote code execution depending on server configuration. Based on the description, it is inferred that the likely attack vector is sending an unauthenticated HTTP request to the list email plugin endpoint. The absence of authentication and the fact that the upload accepts only non‑executable files suggests that an attacker could still attempt to exploit server configurations that misinterpret these files, thereby potentially achieving remote code execution or data exfiltration.