CVE-2020-37219: Fabrikar Com Fabrik

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Joomla com_fabrik 3.9.11 contains a directory traversal vulnerability that allows unauthenticated attackers to list arbitrary files by manipulating the folder parameter. Attackers can send GET requests to the onAjax_files method with path traversal sequences to enumerate files in system directories outside the intended web root.

Affected products

• Fabrikar Com Fabrik: version 3.9.11 only

Published 2026-05-13. Last modified 2026-06-17.