Which versions of Balbooa Com Balbooa Forms Extension For Joomla are affected by CVE-2026-56291?

The Balbooa Forms extension for Joomla contains a critical remote code execution flaw (CVE-2026-56291, CVSS 10.0) through which unauthenticated attackers can execute arbitrary server code and…

Is there a public PoC exploit available for CVE-2026-56291?

Yes, a public proof-of-concept exploit is available for CVE-2026-56291. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-56291?

Within 24 hours: identify all Joomla systems running the Balbooa Forms extension; immediately disable and uninstall the extension; preserve server logs and file uploads for forensic analysis. Within 7 days: conduct forensic investigation of affected systems for backdoors or unauthorized code; restore from verified clean backups if compromise is detected. Within 30 days: migrate to an alternative Joomla form solution; monitor vendor and security advisories for emergency patch release; maintain compensating controls against re-exploitation.

Balbooa Com Balbooa Forms Extension For Joomla CVE-2026-56291

Q: What is the CVSS score of CVE-2026-56291?

CVE-2026-56291 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red. EPSS exploitation probability: 0.3%.

EUVD-2026-42573 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-09 Joomla

GHSA-28f5-j5p5-xmmw

File Upload Balbooa Com Balbooa Forms Extension For Joomla Balbooa Com

10.0

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red

Primary rating from Vendor (Joomla) · only source for this CVE.

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Added to CISA KEV

Jul 10, 2026 - 17:16 CISA

Analysis Generated

Jul 09, 2026 - 11:25 vuln.today

CVE Published

Jul 09, 2026 - 09:53 cve.org

CRITICAL 10.0

DescriptionCVE.org

The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

Articles & Coverage 1

POC CVE-2026-56291: Balbooa Forms Joomla Extension Pre-Auth File Upload RCE (CVSS 9.8, CISA KEV) Jul 11, 2026

AnalysisAI

Unauthenticated arbitrary file upload in the Balbooa Forms extension for Joomla lets remote attackers upload executable server-side scripts and achieve full remote code execution. The flaw carries a maximum CVSS 4.0 base score of 10.0 with a scope change, meaning a successful upload compromises the underlying host beyond the vulnerable extension. No public exploit identified at time of analysis, though a third-party write-up (mysites.guru) documents the flaw and the supplied CVSS metadata asserts observed attack activity.