Balbooa Forms EUVD-2026-89101

Requires that the target Balbooa Forms instance (< 2.4.3.4) has a publicly reachable form whose 'auto reply' option AND 'attach uploaded files' option are both enabled - this is the AT:P attack requirement and the primary limiting factor. Given that, no authentication, no session, no valid attachment/upload row, and no user interaction are needed: a Guest submits attacker-controlled upload-field JSON with a merely numeric-looking id plus a traversal filename (e.g. '../../../../configuration.php') and an attacker-chosen email address. Exfiltration is bounded to files readable by the Joomla/web-server process. Sites without auto-reply-with-attachments configured are not exploitable via this path.

This is a genuinely high-risk, unauthenticated arbitrary-file-read flaw where the CVSS 4.0 score (8.9) is well-justified rather than inflated. The vector AV:N/AC:L/PR:N/UI:N confirms remote, network-based exploitation requiring no authentication and no user interaction - a Guest can trigger it via a normal public form submission. VC:H with SC:H reflects that a successful read of Joomla's configuration.php discloses database credentials and secrets, effectively compromising the whole host beyond the vulnerable component. The single mitigating signal is AT:P (Attack Requirements: Present), which corresponds to the description's precondition that the form's 'auto reply' and 'attach uploaded files' options both be enabled - a common but not universal configuration. No EPSS score, KEV listing, or public POC was provided, so this is 'no public exploit identified at time of analysis'; the absence of active-exploitation evidence tempers urgency but does NOT lower the intrinsic severity, since the flaw is simple to weaponize once the config precondition is met. Net: a real priority for any site running vulnerable Balbooa Forms with auto-reply enabled, not a paper-tiger high-CVSS.

An unauthenticated attacker submits a public Balbooa Form on a target Joomla site, injecting crafted upload-field JSON containing a fake numeric id and a traversal filename like '../../../../configuration.php', and supplies their own address in the form's email field. Because the form has auto-reply with 'attach uploaded files' enabled, the component emails the referenced local file back to the attacker, leaking Joomla DB credentials and secrets. No public exploit code is identified at time of analysis, but the technique is trivial to reproduce from the description.