CVE-2026-56291 Details
Description
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
A vulnerability in the Joomla extension Balbooa Forms, specifically in versions through 2.4.0, allows unauthenticated users to upload arbitrary files, including executable PHP files. This flaw is due to the upload feature accepting files from anonymous visitors without authentication, CSRF token verification, or proper file type restrictions. Exploitation of this vulnerability results in full remote code execution on the server.
Users are advised to update Balbooa Forms to version 2.4.1 or later. After updating, it is recommended to check the site for any unauthorized files or admin accounts, as the vulnerability was actively exploited before the patch was released.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56291 | CISA-ADP | US Government Resource |
| https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/ | [email protected] | ExploitThird Party Advisory |
| https://www.balbooa.com/joomla-forms | [email protected] | Product |
This CVE is in CISA's Known Exploited Vulnerabilities Catalog
Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
| Vulnerability Name | Date Added | Due Date | Required Action |
|---|---|---|---|
| Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability | Jul 10, 2026 | Jul 13, 2026 | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| balbooa forms | < 2.4.1 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | Modified Analysis | [email protected] |
| Jul 23, 2026 | CVE Modified | [email protected] |
| Jul 11, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | Modified Analysis | [email protected] |
| Jul 10, 2026 | CVE CISA KEV Update | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | Initial Analysis | [email protected] |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |