CVE-2026-56291: critical vulnerability in balbooa.com Balbooa Forms extension for Joomla
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
Published · Updated
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
The Balbooa Forms extension for Joomla allows anyone to upload files without logging in, including dangerous executable files that can take over the entire website. This is a critical vulnerability that gives attackers complete control of the server.
CWE-434 unrestricted file upload in Balbooa Forms < 2.4.1 permits unauthenticated attackers to upload arbitrary executable files via the form submission endpoint, bypassing authentication and file-type validation controls, resulting in remote code execution with full server privileges.
The full analysis of this CVE is available in Portuguese →