CVE-2026-56291: Balbooa Forms Joomla extension unauthenticated arbitrary file upload RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable arbitrary file upload leading to full RCE, with a CVSS 4.0 score of 10, KEV listing and a public exploit reference.

What it is

The Balbooa Forms extension for Joomla before version 2.4.1 accepts file uploads without authentication and does not restrict file type, allowing executable files to be placed on the server. Because the uploaded file can be executed, this leads to full remote code execution on the hosting web server.

Impact

An unauthenticated attacker can upload and execute arbitrary code, gaining full control of the Joomla site and potentially the underlying host. This enables data theft, defacement, persistence and use of the server as a foothold for further attacks.

Attack surface

Reachable over the network through the Joomla site's HTTP interface with no authentication and no user interaction required, per the CVSS 4.0 vector (AV:N/PR:N/UI:N). Any internet-exposed Joomla installation running the vulnerable Balbooa Forms extension is a candidate target.

Exploitation

The vulnerability is listed in CISA KEV with a due date of 2026-07-13, and a public exploit reference is tagged Exploit, indicating active exploitation. EPSS gives a 30-day probability of 0.14854 (96.5th percentile), consistent with meaningful exploitation activity.

What to do

• Upgrade Balbooa Forms to version 2.4.1 or later immediately.
• If patching is not possible, disable or remove the Balbooa Forms extension until it can be updated.
• Block or restrict upload endpoints at the web application firewall and disallow execution of uploaded files in upload directories.
• Apply CISA BOD 26-04 guidance and, if no mitigation is available, discontinue use of the product.
• Review server file permissions and web server configuration to prevent script execution in writable upload paths.

Detection

• Monitor web server and Joomla logs for POST requests to Balbooa Forms upload endpoints, especially from unauthenticated sessions.
• Alert on newly created executable files (PHP, JSP, etc.) in upload or media directories.
• Hunt for unexpected outbound connections or web shell activity originating from the Joomla host.
• Correlate file creation events with subsequent process execution by the web server user.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.