CVE-2026-56291

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.1

Description The Joomla extension Balbooa Forms, installed as the com baforms component, contains a flaw in its frontend attachment upload functionality. This issue allows an unauthenticated anonymous visitor to upload arbitrary executable files, such as .php files, into a public folder without requiring a login or a CSRF token (Cross-Site Request Forgery token, a unique value used to prevent unauthorized commands from being transmitted from a user that the web application trusts). This leads to remote code execution (RCE), enabling an attacker to execute arbitrary code on the server. This issue has been actively exploited in the wild.

Recommendations Update the extension to a version newer than 2.4.0.