Balbooa Forms EUVD-2026-89096

Requires a public-facing Balbooa Forms (<2.4.3.4) form that exposes a file-upload field on an endpoint reachable without authentication - the attacker needs no account to plant the payload, only a form accepting uploads. The payload does NOT fire on upload: it executes only when a Joomla administrator subsequently opens the attacker's submission in the backend (CVSS 4.0 UI:A / mapped UI:R), so exploitation depends on privileged human interaction and cannot be fully automated. The filename must still pass the endpoint's extension and MIME validation, so the payload has to be crafted within an allowed file type while carrying script in the original multipart filename string. Limiting factors: forms without upload fields or admins who never view submissions are not exploitable.

This is a genuine, well-understood stored XSS with a realistic cross-privilege escalation path, though the vendor CVSS 4.0 8.6 overstates it. The chain is clean: the public upload endpoint is reachable unauthenticated (CVSS 4.0 PR:N), an attacker plants a malicious filename that is stored verbatim, and the payload later executes in the Joomla ADMINISTRATOR backend when a privileged user opens the submission - a scope/privilege boundary crossing that raises real impact. However, the vendor's VC:H/VI:H (high confidentiality and integrity impact) is aggressive for a reflected-into-DOM XSS; standard scoring treats admin-context script injection as C:L/I:L with a scope change, not full compromise, so my independent assessment lands around 6.1 (CVSS 3.1). Critically, exploitation is NOT automatable end-to-end: it hinges on UI:A/UI:R - an administrator must actually open the attacker's submission - which gates timing and success. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no evidence of active exploitation; treat this as a credible but non-urgent priority. Signals are broadly consistent (network vector, low complexity, no auth to plant, admin interaction to fire); the main conflict is vendor impact inflation versus the actual XSS technical impact, which should be reconciled downward.

An anonymous attacker submits a file through a public Balbooa Forms upload field, naming the file with an XSS payload as its multipart filename (e.g. containing an <img onerror> or <script> vector) that passes the extension and MIME checks. The filename is stored verbatim and linked to an anonymous submission. When a Joomla administrator later opens that submission in the backend, the component's JavaScript concatenates file.name into an HTML string assigned to innerHTML, executing the attacker's script in the admin's authenticated backend session. No public exploit code is identified at time of analysis.