CVE-2026-56291 hits Balbooa Forms on Joomla

Balbooa Forms, the Joomla component, was exposed by CVE-2026-56291, a critical unauthenticated arbitrary file upload flaw that can be used to upload executables and achieve full remote code execution. The issue was disclosed as a zero-day already under active exploitation before a patch was available, with a CVSS base score of 10.0 and CWE-434.

What happened

The official CVE-2026-56291 record says all versions earlier than 2.4.1 are vulnerable. According to that advisory, the flaw is classified as an unrestricted upload of a file with a dangerous type. Several independent advisories, including SentinelOne, Yazoul and PT Security dbugs, agree that the vulnerability affects Balbooa Forms rather than the Joomla core, and that it allows attackers to upload executable web shells into public directories.

What Balbooa fixed

Balbooa released version 2.4.1 on July 9, 2026 and, according to Cyberwald and CTI Pilot, added four mitigation layers. The update introduced an allowlist of extensions per upload field, a new field to check MIME type, random server-side file naming, and a CSRF token requirement on the upload endpoint.

How it was exploited

A Spanish technical analysis published by TechConsulting says the frontend upload handler accepted files from any user without authentication, without a CSRF token and without an allowlist of extensions, while trusting the filename supplied by the sender. That behavior allowed .php files to be uploaded into a public directory and executed for RCE.

DFT Info, citing lab tests from JRT Technology Solutions, went further and said exploitation could be carried out with a simple HTTP POST request to the upload mechanism, because of failures in MIME type checking and file extension validation. That report also says the flaw was being actively exploited in real environments and would have been added to CISA's Known Exploited Vulnerabilities catalog, although that point is attributed to that source and not confirmed in the available material.

Recommendations and scope

Technical advisories recommend treating any Joomla site that ran Balbooa Forms 2.4.0 or earlier as potentially compromised. Suggested steps include auditing upload directories for unusual .php or .phtml files, checking for unauthorized Super User accounts, and blocking PHP execution in upload directories through Apache or Nginx configuration.

They also recommend temporarily disabling Balbooa Forms if immediate patching is not possible, restricting endpoints by IP or WAF, and following a compromise-assumed process with forensic analysis, credential rotation and restoration from clean backups. Devel Group also said CISA added the vulnerability to the Known Exploited Vulnerabilities catalog and recommended targeted hunting in HTTP POST logs to Joomla extension paths, including Balbooa Forms.