A critical code injection vulnerability in the Fabrik extension for Joomla allows unauthenticated attackers to execute arbitrary code, posing a severe risk to site integrity.

This vulnerability involves improper control of code generation (CWE-94) triggered by a heredoc terminator breakout in the calc element. The onUpdateComment endpoint fails to perform necessary capability checks, allowing unauthenticated remote attackers to reach the vulnerable code path.

Successful exploitation permits an unauthenticated attacker to achieve remote code execution on the underlying server. Given the CVSS score of 9.5, this vulnerability represents a critical risk that could lead to full site compromise, data exfiltration, and unauthorized administrative control over the Joomla environment.

Immediate Action: Update the Fabrik extension to version 4.7.2 or the latest available release to resolve the injection flaw.

Proactive Monitoring: Review web server and Joomla access logs for suspicious requests directed at the onUpdateComment endpoint or unusual calc element interactions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unexpected input patterns and unauthorized access attempts to known extension endpoints.

Public Exploit Available: Unknown.

This vulnerability is highly critical and requires immediate attention to prevent unauthorized system access. Administrators must prioritize updating the Fabrik extension to the patched version, as the lack of authentication makes the attack surface extremely broad and easy to target.