CVE-2026-101127

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.4

Description An unauthenticated stored Cross-Site Scripting (XSS) issue exists in the public form upload endpoint. While the endpoint validates file extensions and MIME types, it stores the original multipart filename provided by the user verbatim in the # baforms submissions attachments.name field. A subsequent anonymous form submission can associate this temporary attachment with a new submission. When an administrator views the submission, the component's JavaScript retrieves the stored attachment record and concatenates the file.name variable directly into an HTML string, which is then assigned to innerHTML. XSS is a technique where malicious scripts are injected into trusted websites.

Recommendations Update Balbooa Forms to version 2.4.3.4 or later.