CVE-2020-37219 HIGH

CVE-2020-37219: Joomla com_fabrik 3.9.11 Directory Traversal via image.php

Vendor Fabrikar

Product com_fabrik

Weakness CWE-22 · Path traversal

Published May 13, 2026

Last update May 13, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

Description

Joomla com_fabrik 3.9.11 contains a directory traversal vulnerability that allows unauthenticated attackers to list arbitrary files by manipulating the folder parameter. Attackers can send GET requests to the onAjax_files method with path traversal sequences to enumerate files in system directories outside the intended web root.

Key dates

Disclosure timeline

May 13, 2026 CVE published

May 13, 2026 Record updated