First Seen: July 8, 2026

Affected Products: Balbooa Forms

CVE-2026-56291 is a critical (CVSS 10.0) unauthenticated arbitrary file upload flaw in the Balbooa Forms Joomla extension that allows any anonymous attacker to upload a malicious .php file and achieve full remote code execution in a single request. The vulnerability was exploited as a zero-day in the wild before a fix existed, and exploitation remains ongoing against unpatched sites. All versions up to and including 2.4.0 are affected; version 2.4.1 (released 9 July 2026) remediates the flaw. Organizations running Balbooa Forms should update to 2.4.1 immediately and inspect affected sites for signs of prior compromise.

Critical Unauthenticated Upload Flaw

CVE-2026-56291 is a critical unauthenticated arbitrary file upload vulnerability affecting Balbooa Forms, a drag-and-drop form-builder extension for Joomla (installed as the com_baforms component). The flaw is classed as CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS 4.0 base score of 10.0 (Critical), remotely exploitable in a single request, with no privileges or user interaction, culminating in full remote code execution.

Root Cause

The root cause is a frontend attachment upload handler that performed no authentication, CSRF, or file-type validation. The endpoint accepted a file from any anonymous visitor with no login requirement and no allow-list on the file extension; while the filename was partially sanitized, that process did not reject a .php extension, so a caller-supplied .php file could be written into a public, PHP-executable directory and then invoked directly. Upload therefore converted straight into code execution, granting an attacker a server foothold with no account required on the target site.

Zero-Day Exploitation

The vulnerability was exploited as a zero-day. It came to light through an abuse report on a live Joomla site, submitted as a raw web-server access log that evidenced active exploitation in the wild before any patch existed. Exploitation remains ongoing against unpatched instances.

Affected Versions and Remediation

All versions up to and including 2.4.0 are affected; the flaw was remediated in version 2.4.1, released 9 July 2026, which hardens the upload path at four layers (server-side extension allow-list, MIME-type validation, forced server-side filenames, and a CSRF token check). Affected instances should be updated immediately and inspected for stray .php files in the upload directory and unrecognized Super User accounts, as pre-patch systems may already be compromised.

At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.

Book a Demo of HivePro.