CVE-2026-77992

The Joomla Extension from fabrikar.com is vulnerable due to a heredoc terminator breakout in the calc element, specifically in versions prior to 4.7.2, which allows unauthorized access through the onUpdateComment endpoint without proper access checks. This critical vulnerability (CVSS 9.5) could lead to arbitrary code execution or data manipulation, posing significant risks to affected Joomla installations. Organizations using this extension should prioritize immediate updates to version 4.7.2 or later to mitigate potential exploitation.