sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2026-102424 Path traversal in Balbooa Forms extension for Joomla

High 8.9 Published Updated

Unauthenticated attackers can exfiltrate local files via path traversal in Balbooa Forms auto-reply attachments when specific options are enabled.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2026-102424?

CVE-2026-102424 is a high-severity path traversal vulnerability in balbooa.com Balbooa Forms extension for Joomla, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose `id` merely looks numeric, the component trusts the supplied `filename`, concatenates it below the configured upload directory, and adds the result to an array of local attachment paths. It does not load the referenced attachment row, verify ownership/session/form/field, require that the ID exists, canonicalize the path, or enforce containment. If the form's normal “auto reply” and “attach uploaded files” options are enabled, the component sends those local paths as email attachments to the address submitted in an email field. A Guest can therefore submit a nonexistent numeric ID plus a traversal filename such as `../../../../configuration.php` and receive any file readable by the Joomla process.

Weakness: CWE-22

Which versions are affected by CVE-2026-102424?

It affects 1 product.

Products include Balbooa Forms.

How do I fix CVE-2026-102424?

No fix has been published for CVE-2026-102424 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-102424 being exploited?

There is no known exploitation of CVE-2026-102424 in the wild and no public exploit code.

Sources

Also known as GHSA-j3r3-fqf7-gc2r.

Is CVE-2026-102424 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free