此页面尚未翻译为您的语言。我们正在努力翻译，目前显示英文内容。
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2020-37219: Directory Traversal in Joomla com_fabrik
平台
joomla
组件
com_fabrik
CVE-2020-37219 represents a directory traversal vulnerability discovered in Joomla's comfabrik component. This flaw allows unauthenticated attackers to potentially access sensitive files on the server by manipulating the 'folder' parameter within specific requests. The vulnerability affects versions 3.9.11–3.9.11 of comfabrik, and a patch is available from the Joomla project.
检测此 CVE 是否影响你的项目
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。
影响与攻击场景翻译中…
The directory traversal vulnerability in comfabrik poses a significant risk. An attacker can exploit this flaw by crafting malicious GET requests to the onAjaxfiles method, using path traversal sequences (e.g., ../..) to navigate outside the intended web root directory. This allows them to enumerate files within the system, potentially exposing configuration files, database credentials, or other sensitive data. Successful exploitation could lead to complete server compromise and data exfiltration. While no widespread exploitation has been publicly reported, the ease of exploitation makes it a high-priority concern.
利用背景翻译中…
CVE-2020-37219 was published on May 13, 2026. Its severity is rated as HIGH (CVSS 7.5). Currently, there are no known public exploits or active campaigns targeting this vulnerability. It is not listed on CISA KEV. The ease of exploitation suggests it remains a potential target for opportunistic attackers.
威胁情报
漏洞利用状态
CISA SSVC
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 低 — 无需特殊条件，可以稳定地利用漏洞。
- Privileges Required
- 无 — 无需认证，无需凭证即可利用。
- User Interaction
- 无 — 攻击自动且无声，受害者无需任何操作。
- Scope
- 未改变 — 影响仅限于脆弱组件本身。
- Confidentiality
- 高 — 完全丧失机密性，攻击者可读取所有数据。
- Integrity
- 无 — 无完整性影响。
- Availability
- 无 — 无可用性影响。
受影响的软件
弱点分类 (CWE)
时间线
- 已保留
- 发布日期
缓解措施和替代方案翻译中…
The primary mitigation for CVE-2020-37219 is to immediately upgrade to a patched version of Joomla com_fabrik. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal sequences in the 'folder' parameter. Additionally, restrict file permissions on sensitive directories to prevent unauthorized access. Regularly review Joomla's security advisories for updates and best practices. After upgrade, confirm the vulnerability is resolved by attempting a directory traversal request and verifying that access is denied.
修复方法翻译中…
Actualice el componente com_fabrik a una versión corregida. Consulte la documentación de Fabrikar o su sitio web para obtener instrucciones específicas sobre cómo actualizar y obtener la última versión.
常见问题翻译中…
What is CVE-2020-37219 — Directory Traversal in Joomla com_fabrik?
CVE-2020-37219 is a vulnerability in Joomla's com_fabrik component allowing unauthenticated attackers to list files by manipulating the folder parameter, potentially exposing sensitive data.
Am I affected by CVE-2020-37219 in Joomla com_fabrik?
You are affected if you are running Joomla com_fabrik version 3.9.11–3.9.11. Check your version and upgrade immediately if vulnerable.
How do I fix CVE-2020-37219 in Joomla com_fabrik?
The recommended fix is to upgrade to a patched version of Joomla com_fabrik. If immediate upgrade is not possible, implement WAF rules to block malicious requests.
Is CVE-2020-37219 being actively exploited?
While no widespread exploitation has been publicly reported, the ease of exploitation makes it a potential target. Proactive mitigation is recommended.
Where can I find the official Joomla advisory for CVE-2020-37219?
Refer to the official Joomla security advisory for detailed information and updates: [https://security.joomla.org/latest-security-advisories](https://security.joomla.org/latest-security-advisories)
检测此 CVE 是否影响你的项目
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。
立即扫描您的Joomla项目 — 无需账户
上传任何清单文件 (composer.lock, package-lock.json, WordPress 插件列表…) 或粘贴您的组件列表。您立即获得一份漏洞报告。上传文件只是开始：拥有账户后，您将获得持续监控、Slack/电子邮件警报、多项目和白标报告。
拖放您的依赖文件
composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...