CVE-2026-102424

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.4

Description An unauthenticated path traversal issue exists where the component accepts upload-field state as guest-controlled JSON during public form submission. If the auto-reply and attach uploaded files options are enabled, the component trusts the supplied filename for objects with a numeric id and concatenates it with the upload directory without verifying ownership, session, or enforcing path containment. This allows a guest to submit a nonexistent numeric ID and a traversal filename, such as ../../../../configuration.php, causing the system to send local files as email attachments to the submitted email address.

Recommendations Update Balbooa Forms to version 2.4.3.4. As a temporary mitigation, disable the auto-reply and attach uploaded files options in the form settings.