Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-56291 – Unauthenticated File Upload Leading to RCE – Balbooa Forms extension for Joomla …

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-56291 is a critical unauthenticated arbitrary file upload vulnerability in the Balbooa Forms extension for Joomla (com_baforms), affecting all versions up to and including 2.4.0. The flaw allows any remote, unauthenticated attacker to upload executable PHP files directly to the server and achieve full Remote Code Execution (RCE), earning a maximum CVSS 4.0 score of 10.0. Active exploitation of this vulnerability has been observed in the wild prior to the availability of a patch.

Technical details

  • Root cause: The frontend attachment upload handler (FormModel::uploadAttachmentFile) accepted file uploads from anonymous visitors with no authentication check, no CSRF token validation, and no server-side file extension whitelist. The handler extracted file extensions directly from attacker-controlled filenames and applied only Joomla’s File::makeSafe() name sanitization, which does not block .php extensions, writing uploaded files to the publicly accessible images/baforms/uploads/ directory with the original extension intact.
  • Trigger conditions: An attacker sends a crafted HTTP request to the endpoint index.php?option=com_baforms&task=form.uploadAttachmentFile with a PHP web shell as the uploaded file — no account, session, or prior access is required.
  • Attack vector: Network-accessible, unauthenticated, zero user interaction required, low attack complexity (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N).
  • Impact: Full Remote Code Execution on the hosting server. Successful exploitation results in complete compromise of confidentiality, integrity, and availability on both the vulnerable system and any systems reachable from it (CVSS 4.0: VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). Active exploitation evidence has been observed (E:A).
  • CWE: CWE-434 – Unrestricted Upload of File with Dangerous Type.

Affected software

  • Balbooa Forms extension for Joomla — all versions from 1.0 through 2.4.0 (inclusive)
  • Fixed in version 2.4.1 (released July 9, 2026)

Severity

  • CVSS v4.0 Base Score: 10.0 (Critical)
  • CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red

Mitigation and recommended actions

  • Immediate action — patch now: Upgrade Balbooa Forms to version 2.4.1 or later. Version 2.4.1 introduces server-side file extension validation against per-field configuration, MIME type checking, server-generated filenames (removing trust in user-supplied filenames), and CSRF token enforcement on upload requests.
  • If patching is not immediately possible: Disable or restrict public access to Joomla forms that include file attachment/upload fields until the patch can be applied. Consider blocking external access to the upload endpoint (/index.php?option=com_baforms&task=form.uploadAttachmentFile) at the web application firewall or reverse proxy layer.
  • Post-compromise check: If exploitation is suspected, inspect the images/baforms/uploads/ directory for unexpected .php or executable files and review server access logs for requests to that upload endpoint.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge