A serious security flaw has been discovered in the Balbooa Forms extension for Joomla, identified as CVE-2026-102424. This vulnerability could allow an unauthorized attacker to steal sensitive files from your server. It’s crucial for website administrators and developers using this extension to understand the risk and take immediate action to protect their sites.<\/p>\n
The vulnerability stems from an unauthenticated path traversal weakness. This means that even without logging in, a malicious individual could manipulate how the Balbooa Forms extension handles file attachments within its auto-reply feature. By submitting a specially crafted request during a public form submission, an attacker can trick the system into attaching local server files to an auto-reply email, sending them directly to the attacker.<\/p>\n
Product:<\/strong> Balbooa Forms for Joomla!<\/p>\n Published Date:<\/strong> September 29, 2026<\/p>\n Severity:<\/strong> High<\/p>\n Status:<\/strong> Analyzed<\/p>\n The vulnerability impacts Balbooa Forms for Joomla! versions prior to 2.4.3.4. If you are running any version older than 2.4.3.4, your website is at risk.<\/p>\n This vulnerability has been analyzed, confirming the potential for unauthenticated path traversal and local file exfiltration. The severity is rated as HIGH, indicating that exploitation could lead to significant data breaches.<\/p>\n With a severity rating of HIGH, this vulnerability poses a significant threat. Successful exploitation could allow an attacker to gain access to critical server files, including configuration files (like The most important step to secure your Joomla website is to update your Balbooa Forms extension immediately. It is strongly recommended to update to version 2.4.3.4 or a later stable release. This version is expected to contain the necessary patches to address the unauthenticated path traversal vulnerability.<\/p>\n https:\/\/www.balbooa.com\/<\/p>\n","protected":false},"excerpt":{"rendered":" A serious security flaw has been discovered in the Balbooa Forms extension for Joomla, identified as CVE-2026-102424. This vulnerability could allow an unauthorized attacker to steal sensitive files<\/p>\n","protected":false},"author":17,"featured_media":2649,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1191,1290,1178,971,695],"class_list":["post-4143","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-balbooa-forms","tag-file-exfiltration","tag-joomla-security","tag-path-traversal","tag-web-security"],"yoast_head":"\nAffected Products<\/h2>\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
configuration.php<\/code> which often contains database credentials and other sensitive information). This could lead to a complete compromise of the Joomla website and potentially other systems on the same server, resulting in data theft, unauthorized access, and further attacks.<\/p>\nPossible Solutions<\/h2>\n
\n
References<\/h2>\n