CVE-2026-56291
Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability
Description
CVE-2026-56291 is a critical unrestricted file upload vulnerability in the Balbooa Forms extension for Joomla that lets an unauthenticated attacker upload executable files and achieve full remote code execution (RCE) on the server. Because the extension fails to properly validate uploaded file types (CWE-434), an attacker can plant a web shell or other malicious script and have it executed by the web server, gaining complete control over the affected site. No credentials or user interaction are required, which makes this Balbooa Forms vulnerability trivially exploitable over the network. CISA has added CVE-2026-56291 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and public exploit details are already available, making immediate remediation essential.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| balbooa | forms | < 2.4.1 |
References
- https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/(Exploit, Third Party Advisory)
- https://www.balbooa.com/joomla-forms(Product)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56291(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type occurs when software allows users to upload files without properly validating or restricting the file types, letting attackers upload content such as web shells, scripts, or executables that can run on the server. In Balbooa Forms, the file upload feature accepts dangerous file types without adequate validation, so an attacker can upload an executable script (for example a PHP web shell) that the server then executes, leading directly to remote code execution.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2026-56291 carries a CVSS 3.1 score of 9.8 (Critical) and is remotely exploitable over the network with low attack complexity, no authentication, and no user interaction — the worst-case combination for an internet-facing web application. Once an attacker uploads and executes a malicious file, the impact is total: Confidentiality (High): all data processed by the Joomla site, including database contents and form submissions, can be read; Integrity (High): site files, content, and configuration can be modified or backdoored; Availability (High): the attacker can disrupt or take the site offline entirely. Although the scope is unchanged, remote code execution effectively hands the attacker control of the web application and often the underlying account on the host. With CISA confirming active exploitation and an EPSS score in roughly the 94th percentile, unpatched Balbooa Forms installations face a high and immediate likelihood of compromise.
Exploit Maturity
Public exploit information is available for CVE-2026-56291 via mysites.guru, which documents the unauthenticated file upload flaw. CISA has added CVE-2026-56291 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild against Balbooa Forms; ransomware usage is currently listed as unknown. The EPSS score of about 8.6% places this vulnerability in roughly the 94th percentile, indicating a high relative likelihood of exploitation activity, and the combination of an unauthenticated CVSS 9.8 flaw with confirmed KEV status means organizations should treat this as an emergency and patch immediately.
Remediation
- Follow CISA's KEV required action: apply mitigations in accordance with Balbooa's vendor instructions, ensure compliance with BOD 26-04 patching guidance and CISA's Forensics Triage Requirements, and discontinue use of the product if mitigations are unavailable — the KEV due date is July 13, 2026.
- Upgrade Balbooa Forms to version 2.4.1 or later, since all versions before 2.4.1 are affected by this unrestricted file upload vulnerability.
- As an interim mitigation aligned with CWE-434 guidance, restrict or disable file upload functionality in affected forms, enforce a strict whitelist of allowed file extensions, and validate uploaded files by their content (magic bytes/signatures) rather than by extension alone.
- Ensure the upload directory is stored outside the web root or configured so that scripts cannot execute there, and rename uploaded files to strip original extensions and prevent execution.
- Monitor the web server and Joomla logs for suspicious uploads, unexpected PHP files, and web shell activity, and treat any exposed, unpatched installation as potentially compromised — perform forensic triage and check for indicators of compromise.
Technical Details
The vulnerability is an unrestricted file upload (CWE-434) in the Balbooa Forms Joomla extension: the upload handler does not properly validate, restrict, or handle the type of files it accepts, so an unauthenticated attacker can submit an executable file such as a PHP script through the form's upload feature. Because the uploaded file lands in a location where the web server will interpret it, requesting the file executes the attacker's code, resulting in full RCE. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity attack requiring neither privileges nor user interaction, with high impact across confidentiality, integrity, and availability and an unchanged scope. This class of flaw is among the most severe web application vulnerabilities precisely because it collapses the gap between "upload" and "code execution" into a single unauthenticated request.
Frequently Asked Questions
Is CVE-2026-56291 being actively exploited?
Yes. CISA has added CVE-2026-56291 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild against Balbooa Forms, and public exploit details have been published. Ransomware use is currently unknown, but the EPSS score in roughly the 94th percentile signals a high likelihood of exploitation activity.
What products are affected by CVE-2026-56291?
The vulnerability affects the Balbooa Forms extension for Joomla in all versions before 2.4.1. Sites running any release earlier than 2.4.1 should be considered exposed to unauthenticated remote code execution.
How do I fix CVE-2026-56291?
Upgrade Balbooa Forms to version 2.4.1 or later and apply the vendor's mitigations in line with CISA's KEV required action and the due date of July 13, 2026. Until you can patch, restrict or disable file uploads, enforce a strict file-type whitelist, and ensure uploaded files cannot be executed by the web server.
How severe is CVE-2026-56291?
CVE-2026-56291 is rated Critical with a CVSS 3.1 score of 9.8, the highest tier of severity. It allows unauthenticated remote code execution with high impact to confidentiality, integrity, and availability, and its EPSS score sits around the 94th percentile with confirmed active exploitation, making it an urgent priority.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.