Critical Unauthenticated Upload Flaw
CVE-2026-56291 is a critical unauthenticated arbitrary file upload vulnerability affecting Balbooa Forms, a drag-and-drop form-builder extension for Joomla (installed as the com_baforms component). The flaw is classed as CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS 4.0 base score of 10.0 (Critical), remotely exploitable in a single request, with no privileges or user interaction, culminating in full remote code execution.
Root Cause
The root cause is a frontend attachment upload handler that performed no authentication, CSRF, or file-type validation. The endpoint accepted a file from any anonymous visitor with no login requirement and no allow-list on the file extension; while the filename was partially sanitized, that process did not reject a .php extension, so a caller-supplied .php file could be written into a public, PHP-executable directory and then invoked directly. Upload therefore converted straight into code execution, granting an attacker a server foothold with no account required on the target site.
Zero-Day Exploitation
The vulnerability was exploited as a zero-day. It came to light through an abuse report on a live Joomla site, submitted as a raw web-server access log that evidenced active exploitation in the wild before any patch existed. Exploitation remains ongoing against unpatched instances.
Affected Versions and Remediation
All versions up to and including 2.4.0 are affected; the flaw was remediated in version 2.4.1, released 9 July 2026, which hardens the upload path at four layers (server-side extension allow-list, MIME-type validation, forced server-side filenames, and a CSRF token check). Affected instances should be updated immediately and inspected for stray .php files in the upload directory and unrecognized Super User accounts, as pre-patch systems may already be compromised.
