PT-2026-102705
CVE-2026-101126
·
تاريخ النشر
2026-09-29
·
تاريخ التحديث
2026-10-01
الوصف من
CVSS 4.0
6.9
متوسطةالمقاييسAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Balbooa Forms versions prior to 2.4.3.4
Description
The final form submission processes JSON arrays for each upload field but only verifies that IDs are numeric. Because client-supplied filenames and display names are trusted directly, the system is susceptible to metadata tampering, cross-session claiming, and path traversal risks, specifically through the
getFilePath() function.Recommendations
Update Balbooa Forms to version 2.4.3.4 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾