A critical security flaw has been discovered and patched in Balbooa Forms, a popular drag-and-drop form builder for Joomla. This vulnerability, tracked as CVE-2026-56291, allows an attacker to upload malicious executable files without needing any login credentials. This can lead to a complete takeover of your website.
The severity of this issue is extremely high because it was a “zero-day” vulnerability, meaning attackers were already actively exploiting it in the wild before a fix was available. If your Joomla sites use Balbooa Forms version 2.4.0 or older, immediate action is required to protect them.
CVE Details
Product: Balbooa Forms for Joomla
Published: July 9, 2026
Severity: CRITICAL
Status: Analyzed
Affected Products
This vulnerability impacts all versions of the Balbooa Forms extension up to and including version 2.4.0. If your Joomla site is running any of these older versions, it is exposed to this critical threat.
Current Status
The vulnerability has been analyzed and a fix is available. However, active exploitation of this flaw began before a patch was released and is still ongoing against unpatched websites. This means any site running an vulnerable version is currently at risk of being compromised.
Severity Level
CVE-2026-56291 has been assigned a CVSS 4.0 score of 10.0, which is the highest possible rating, indicating a CRITICAL severity. This reflects the ease with which an attacker can exploit the flaw. No special user privileges are needed, no user interaction is required, and the attack can be performed remotely over the internet with a single request. The outcome is full Remote Code Execution (RCE), giving attackers complete control over your server. This allows them to read sensitive data, create new administrative accounts, or install further malicious software.
Possible Solutions
The most important step is to update your Balbooa Forms extension immediately.
Update to version 2.4.1 or later: Balbooa released version 2.4.1 on July 9, 2026, which contains crucial fixes for this vulnerability. Updating will close the security loophole. This is not an update to postpone; it should be applied as soon as possible.
The 2.4.1 update implements several key security improvements:
- Improved File Extension Validation: The system now rigorously checks file extensions against allowed types defined in the form’s configuration. This prevents the upload of dangerous file types like PHP.
- MIME Type Option: A new option allows administrators to enforce matching the file’s actual content type (MIME type) against allowed types, adding another layer of defense.
- Server-Side Filename Generation: Uploaded files are now renamed and stored with server-generated filenames, preventing attackers from using specific filenames to trick the system.
- CSRF Token Check: A Cross-Site Request Forgery (CSRF) token check has been added, ensuring that upload requests originate from legitimate forms on your site.
Mitigation Steps (if immediate update is not possible): If you cannot update immediately, unpublish any public Balbooa Forms forms that allow file attachments. This will temporarily remove the vulnerable upload handler from public access.
Check for Existing Compromises
Since this was an actively exploited zero-day, it is vital to check your sites for any signs of compromise even after updating. Attackers might have already gained a foothold.
- Inspect the Upload Folder: Check the default Balbooa Forms upload directory (typically
images/baforms/uploads/, with subfolders per form) for any suspicious files, especially those ending in.php. - Review Administrator Accounts: Look for any unfamiliar or recently created administrator accounts in your Joomla user list.
- Scan for Modified Files: Check for any recently modified or unexpected PHP files across your site’s file system. Tools like a malware scanner can help detect malicious code or backdoors.
References
https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/
https://www.balbooa.com/joomla-forms
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56291
