CVE-2026-56291

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1

Published Jul 9, 2026 CVSS 4.0 · 10 Critical EPSS 14.9% KEV · Listed

Description

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

Analysis

Technical impact

The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full remote code execution. By uploading malicious files, an attacker can execute code on the server, gaining complete control over the Joomla installation. This flaw aligns with CWE-434 and is considered a critical vulnerability.

Affected Systems

All instances of the Balbooa Forms extension for Joomla with a version earlier than 2.4.1 are affected. The vulnerability applies to any website that has deployed these legacy versions of the extension and has not applied the latest update from balbooa.com.

Risk and Exploitability

The CVSS score of 10 indicates maximum severity. The EPSS score of 15% indicates a lower probability of exploitation; however, the ability to upload arbitrary files without authentication means attackers can exploit it if they have sufficient motivation, especially against exposed web servers. The vulnerability is listed in CISA’s KEV catalog, highlighting that it is actively exploited. Attackers can exploit the flaw without needing to authenticate, making it easily accessible to the general threat landscape.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

balbooa.com

balbooa.com Balbooa Forms extension for Joomla

unaffected

Version	Status	Constraints
`1.0-2.4.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:balbooa:forms:*:*:*:*:*:joomla\!:*:*

No data.

Vendor Product Versions

Balbooa.com

Balbooa.com Balbooa Forms Extension For Joomla

Version	Status	Scheme	Platform
`[1.0,2.4.0)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Balbooa Forms extension to version 2.4.1 or later, which removes the unauthenticated upload functionality.
If an upgrade is not immediately possible, disable the extension or remove its upload directory to block file submissions.
Configure the web server to restrict file system permissions on upload directories, ensuring that uploaded files cannot be executed by the web application process.

Generated by OpenCVE AI on August 24, 2026 at 17:09 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since July 10, 2026.

Exploit prediction score: 14.9% (14.854% probability within 30 days)

Exploitation active

Automatable yes

Technical Impact total

References

Link	Providers
https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/
https://www.balbooa.com/joomla-forms
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56291

History

Jul 23, 2026 3:45 PM Description updated View changes

Type	Values Removed	Values Added
Description	The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.	Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

Jul 10, 2026 6:30 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56291
Metrics	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 10, 2026 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		kev `{'dateAdded': '2026-07-10T00:00:00+00:00', 'dueDate': '2026-07-13T00:00:00+00:00'}`

Jul 10, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Balbooa.com Balbooa.com balbooa.com Balbooa Forms Extension For Joomla
Vendors & Products		Balbooa.com Balbooa.com balbooa.com Balbooa Forms Extension For Joomla

Jul 9, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 9, 2026 10:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
Title		Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
Weaknesses		CWE-434
References		https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/ https://www.balbooa.com/joomla-forms
Metrics		cvssV4_0 `{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red'}`