Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability
Balbooa — Forms
- Added to KEV catalog
- 10 July 2026
- Federal remediation due date
- 13 July 2026
- Weakness classification (CWE)
- CWE-434
AI Breakdown
What it is
Balbooa Forms, a Joomla extension, has a critical vulnerability that allows an attacker to upload dangerous files without needing to log in. This flaw lets them upload executable files, which can give them full remote control over the affected system. This means an attacker could completely compromise your website or server.
Why it matters
This vulnerability is extremely severe, scoring 9.8 out of 10, because it allows attackers to take full control of systems running Balbooa Forms. While it is not currently known to be exploited in ransomware campaigns, its high impact makes it a prime target for malicious actors. Failing to address this could lead to a complete system takeover and significant data breaches.
Recommended action
You must immediately apply any available security updates or mitigations provided by the vendor. Prioritize this action by evaluating your system's internet exposure and following CISA's guidance for security updates and forensic triage requirements. If no mitigations are available, you should discontinue using Balbooa Forms until a fix is released.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://www.balbooa.com/joomla-forms ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56291
NVD Technical Description
The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services