The onAjax_getFolders method in the Fabrik extension for Joomla allows an unauthenticated user to retrieve a listing of directories on the server. This flaw, which arises from improper input handling and insufficient access control, enables the disclosure of filesystem structure and potentially sensitive files. The vulnerability is mapped to CWE‑22 and CWE‑284.

The flaw exists in all versions of the Fabrik extension for Joomla released before 4.7.2, including any installations that have not applied that update. All Joomla sites that have installed the extension from fabrikar.com are potentially impacted.

With a CVSS score of 8.7 the vulnerability is considered high severity. The EPSS score is not available, but the lack of a KEV listing suggests no publicly known exploitation yet. Attackers can exploit the issue by sending a crafted AJAX request directly to the affected endpoint, bypassing authentication entirely; the resulting directory listings could be leveraged to discover configuration files or other assets that might aid further attacks.