CVE-2026-56291 Balbooa Forms Unrestricted Upload of File with Dangerous Type
Unauthenticated attackers can upload executable files to the Balbooa Forms extension, leading to remote code execution.
- Exploited in the wild
- Since 10 Jul 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56291?
CVE-2026-56291 is a critical vulnerability in balbooa.com Balbooa Forms extension for Joomla, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
Weakness: CWE-434
Which versions are affected by CVE-2026-56291?
It affects 1 product.
Products include Balbooa Forms.
How do I fix CVE-2026-56291?
No fix has been published for CVE-2026-56291 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 13 Jul 2026.
Is CVE-2026-56291 being exploited?
Yes. Attackers have exploited CVE-2026-56291 in the wild since at least 10 Jul 2026.
Public exploit code: 1 Nuclei template and 5 proofs of concept on GitHub.
Other vulnerabilities in balbooa.com Balbooa Forms extension for Joomla
- CVE-2026-102425 Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4
- CVE-2026-102424 Path traversal in Balbooa Forms extension for Joomla
- CVE-2026-101127 Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4
- CVE-2026-101112 Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4
- CVE-2026-101126 Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4
Sources
Also known as GHSA-28f5-j5p5-xmmw.