🔴 CVE-2026-56291

CVE-2026-56291 is a critical (CVSS 10.0) unauthenticated arbitrary file upload vulnerability in the Balbooa Forms extension for Joomla (versions 1.0 through 2.4.0) that allows attackers to upload executable files and achieve full remote code execution on the server. The vulnerability requires no authentication or user interaction and is confirmed to be actively exploited in the wild per the CISA KEV catalog. Because Joomla websites and their form extensions are inherently internet-facing, this represents a textbook T1190 exploitation scenario granting direct server compromise.

← Back to Overview
HIGH_RISK
Risk Level
10.0
CVSS Score
NETWORK
Attack Vector
Initial Access
ATT&CK Tactic
T1190 — Exploit Public-Facing Application
ATT&CK Technique
HIGH
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-07-09

Added to CISA KEV: 2026-07-10 1 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-56291 is a critical remote code execution (RCE) vulnerability affecting the Balbooa Forms extension for Joomla, which arises from an unauthenticated arbitrary file upload flaw [1][5]. The vulnerability exists in the extension's file upload handler, which fails to adequately validate the file extension, MIME type, or content of incoming files, allowing attackers to upload and execute malicious files on the server [1]. This is highly significant due to the ease of exploitation by unauthenticated actors and the potential for full server compromise [2].

Exploitation

  • Active Exploitation: The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming it is being actively exploited in the wild [2].
  • Threat Actors/Campaigns: While active exploitation is confirmed, specific details regarding known threat actors or involvement in ransomware campaigns remain currently unknown or under investigation [3].
  • Availability: Public technical details and analysis are available, which facilitate the development of exploit tools [1].
  • Attack Prerequisites:
- Network access: Yes (the service is network-facing). - Authentication required: No (the vulnerability is exploitable by unauthenticated attackers). - User interaction needed: No.

Affected Products & Patches

  • Affected Versions: Balbooa Forms extension for Joomla versions prior to 2.4.1 [4].
  • Patch Availability: Users are advised to upgrade to version 2.4.1 or later to remediate the vulnerability [1].
  • Mitigations: If an immediate update is not possible, administrators should disable the file upload functionality in the Balbooa Forms extension or restrict access to the affected form submission endpoints via web application firewall (WAF) rules until patching is completed.

Impact

  • Access/Capability: Successful exploitation grants an attacker the ability to execute arbitrary code on the underlying server with the privileges of the web application, leading to full Remote Code Execution (RCE) [1][4].
  • Business Risk: For internet-facing deployments, this flaw poses an extreme risk, as it allows attackers to gain unauthorized persistence, exfiltrate sensitive site data, pivot to internal networks, or potentially deploy additional malicious payloads (such as backdoors or ransomware) without any prerequisite authentication [2].

Sources

  1. CVE-2026-56291: Balbooa Forms Joomla Extension RCE Flaw

    CVE-2026-56291 is a remote code execution vulnerability in the Balbooa Forms extension for Joomla that allows unauthenticated attackers to upload malicious files. This article covers technical details, affected versions, and mitigation.The vulnerability resides in the file upload handler exposed by…

  2. CVE-2026-56291 - Vulnerability Details - OpenCVE

    The vulnerability is listed in CISA’s KEV catalog, highlighting that it is actively exploited. Attackers can exploit the flaw without needing to authenticate, making it easily accessible to the general threat landscape. Generated by OpenCVE AI on August 24, 2026 at 17:09 UTC. ... , "descriptions": […

  3. Known Exploited Vulnerabilities Catalog

    Known To Be Used in Ransomware Campaigns? Unknown · Forensic triage required per BOD-26-04: No · Date Added: 2026-05-01 · Due Date: 2026- ...

  4. NVD-CVE-2026-56291

    CVE-2026-56291 Detail Description Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

  5. NVD-CVE-2026-56291 - National Vulnerability Database

    1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and ...

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed