Critical severity9.8CISA KEVNVD Advisory· Published Jul 9, 2026· Updated Jul 24, 2026

CVE-2026-56291

Description

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

Affected products

Balbooa/Forms
cpe:2.3:a:balbooa:forms:*:*:*:*:*:joomla\!:*:*
Range: <2.4.1
Balbooa.com/Balbooa Formsllm-fuzzy
Range: <2.4.1

Patches

Vulnerability mechanics

References

mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/nvdExploitThird Party Advisory
www.balbooa.com/joomla-formsnvdProduct
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.061
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.000