CVE-2026-56291

CVE-2026-56291 is an unauthenticated unrestricted file upload flaw (CWE-434) in the Balbooa Forms extension for Joomla, affecting versions prior to 2.4.1. Because the upload functionality requires no authentication, any remote attacker who can reach a site running the extension can upload arbitrary files, including executable file types, to the web server. Uploaded executable files can subsequently be invoked on the server, resulting in full remote code execution with high impact on confidentiality, integrity, and availability. Any Joomla site running Balbooa Forms below version 2.4.1 is affected, particularly those whose upload functionality is reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-10 after reportedly being exploited as a zero-day, and a public proof-of-concept write-up is available.

What to do: Upgrade Balbooa Forms to version 2.4.1 or later immediately, as patching is the required action under CISA KEV/BOD 26-04 guidance. If upgrading is not immediately possible, restrict unauthenticated access to the extension's upload functionality at the web server or WAF layer and inspect upload directories for unexpected executable files that would indicate compromise. Review web logs for unauthenticated upload requests from unknown sources and treat any findings as potential RCE incidents.