Alex Joseph
Joomla Extension Users: Be Aware of Balbooa Forms Vulnerability
Joomla users, particularly those relying on the Balbooa Forms extension, should be aware of a recently identified security flaw. This vulnerability, identified as CVE-2026-101126, involves improper handling of file metadata during form submissions. Essentially, the system trusts filenames and display names provided by users without adequate checks. This oversight creates opportunities for malicious actors to tamper with file metadata, potentially claim ownership of files across different user sessions, and even attempt path traversal attacks.
CVE Details
- Product: Balbooa Forms for Joomla!
- Published: September 29, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
The vulnerability impacts all versions of the Balbooa Forms extension for Joomla! prior to version 2.4.3.4. If you are running an older version, your installation could be at risk.
Current Status
This vulnerability has been officially analyzed and documented, meaning its details are publicly known. This highlights the urgency for affected users to address the issue.
Severity Level
Rated with a CVSS score of 6.5, this is considered a Medium severity vulnerability. While not critical, a successful exploitation could lead to unauthorized modification of file data, integrity issues, and potentially allow attackers to access or manipulate files outside of their intended directories. For website administrators and developers, addressing medium-severity flaws is crucial to maintaining a secure and trustworthy online environment.
Possible Solutions
To protect your Joomla! website from this file metadata tampering and path traversal vulnerability, the most critical step is to update your Balbooa Forms extension. Ensure you upgrade to version 2.4.3.4 or any later release as soon as possible. Newer versions typically include the necessary patches to close these security gaps. Always back up your website before performing any updates.
References
https://www.balbooa.com/
