EUVD-2026-42573
GHSA-28f5-j5p5-xmmw
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 09, 2026
Unauthenticated arbitrary file upload in the Balbooa Forms extension for Joomla lets remote attackers upload executable server-side scripts and achieve full remote code execution. The flaw carries a maximum CVSS 4.0 base score of 10.0 with a scope change, meaning a successful upload compromises the underlying host beyond the vulnerable extension. No public exploit identified at time of analysis, though a third-party write-up (mysites.guru) documents the flaw and the supplied CVSS metadata asserts observed attack activity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Balbooa Com Balbooa Forms Extension For Joomla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
Primary rating from Vendor (Joomla) · only source for this CVE.
CVSS VectorVendor: Joomla
Lifecycle Timeline
2DescriptionCVE.org
The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
Articles & Coverage 1
Executive ViewAI
The Balbooa Forms extension for Joomla contains a critical remote code execution flaw (CVE-2026-56291, CVSS 10.0) through which unauthenticated attackers can execute arbitrary server code and completely compromise affected installations and their underlying infrastructure. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis, making immediate containment through extension removal the sole effective mitigation. Organizations must prioritize urgent deactivation of this extension across all Joomla deployments to eliminate the attack vector.
Within 24 hours: identify all Joomla systems running the Balbooa Forms extension; immediately disable and uninstall the extension; preserve server logs and file uploads for forensic analysis. Within 7 days: conduct forensic investigation of affected systems for backdoors or unauthorized code; restore from verified clean backups if compromise is detected. Within 30 days: migrate to an alternative Joomla form solution; monitor vendor and security advisories for emergency patch release; maintain compensating controls against re-exploitation.
No vendor-released patch identified at time of analysis. Interim mitigations: immediately remove the Balbooa Forms extension from all Joomla instances; deploy Web Application Firewall rules to block uploads to plugin directories; enforce strict file type validation and disable script execution in upload directories; implement file integrity monitoring on web-accessible paths; isolate vulnerable Joomla servers from systems containing sensitive data; maintain isolated offline backups for recovery.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Exploit-DB