The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload

Balbooa Forms is a widely deployed Joomla forms/builder extension. Through version 2.4.0, its frontend attachment upload handler took files from anonymous visitors with no authentication, no CSRF token, and no allowlist on file type or extension. An attacker POSTs a PHP payload to the form endpoint, the file lands under the site's writable uploads directory, and then a second GET executes it as the web-server user. The fix ships in 2.4.1 (released 2026-07-09); everything ≤ 2.4.0 is exploitable.

The vendor CRITICAL / 9.8 rating is accurate and if anything conservative. The vector is AV:N/AC:L/PR:N/UI:N with full CIA impact, and CISA added it to KEV on the same day as disclosure because in-the-wild exploitation was already underway. There is no meaningful friction — no auth, no user interaction, no rare configuration. This is a single-request unauth RCE against internet-facing PHP.

Why this verdict

• No auth, no CSRF, no MIME check — the vendor advisory and PoC both confirm the endpoint accepts anonymous PHP uploads. There is no prerequisite compromise stage to soften severity.
• KEV as of disclosure day — CISA doesn't list on speculation. Active exploitation overrides EPSS's low 0.00836 score, which lags by weeks.
• Role multiplier — web-facing CMS component: the chain succeeds on the canonical deployment (public Joomla site with a contact/lead form). Blast radius: full site compromise → DB creds → potential lateral movement on shared hosting or reused admin creds → SEO poisoning, skimming, or foothold for further internal pivot.
• Compensating deployment hardening is rare — Joomla installs do not ship with PHP execution disabled in upload directories by default; SELinux/AppArmor is not the norm on shared LAMP hosting.
• Patch and mitigation are both cheap — 2.4.1 is a drop-in extension update. There is no operational reason to delay.

Why not higher?

9.8 is already at the CRITICAL ceiling for CVSS 3.1 in this configuration; the only headroom would be a Scope-changed variant, which is not applicable to a userland PHP webshell. There is no separate 'CRITICAL+' bucket in noisgate.

Why not lower?

Downgrading would require either evidence that the exposed population is trivial (it is not — Balbooa Forms is a mainstream Joomla forms extension) or evidence that exploitation requires a rare prerequisite (it does not — anonymous single-request). Neither condition holds.

1. Disable the Balbooa Forms component in Joomla until 2.4.1 is applied — Site Admin → Extensions → Manage → set com_baforms to Disabled. This zeroes the attack surface immediately. Deploy within 3 days per noisgate mitigation SLA — but given KEV, do it in the next maintenance window today.
2. Add a WAF virtual patch blocking multipart POSTs to Balbooa endpoints with executable extensions — In Cloudflare/AWS WAF/ModSecurity, block requests to /index.php?option=com_baforms* that contain Content-Disposition: filename= with .php, .phtml, .phar, .php3-8, .pht, .inc. Deploy within 24 hours if you cannot disable the component.
3. Deny PHP execution in Joomla upload directories — Drop .htaccess with <FilesMatch \.ph(p[3-8]?|tml|ar)$> Require all denied </FilesMatch> under /images/, /media/, and any Balbooa upload path. For nginx add location ~ ^/(images|media)/.*\.php$ { deny all; }. Do this now and keep it after patching.
4. Hunt for existing webshells — KEV-listed with pre-patch exploitation means you may already be popped. Grep uploads directories for <?php, unusual filenames (high entropy, mixed case), files newer than 2026-06-01, and Joomla #__users for unexpected Super Users. Run within 24 hours.
5. Rotate secrets in configuration.php and DB creds — If you find any indicator of compromise, treat DB credentials, Joomla secret, API tokens, and any admin passwords as burned. Rotate before restoring the patched site.

Run on each Joomla host as any user that can read the webroot. Invoke as ./check-baforms.sh /var/www/html (path to Joomla document root). Also runs a live HTTP probe against the site — provide site URL as SITE_URL=https://example.com ./check-baforms.sh /var/www/html. Prints VULNERABLE, PATCHED, or UNKNOWN and exits with 1/0/2 respectively.

#!/usr/bin/env bash
# noisgate: CVE-2026-56291 — Balbooa Forms unauth file upload
# Usage: ./check-baforms.sh <joomla-webroot>
# Optional: SITE_URL=https://site.tld ./check-baforms.sh <webroot>
set -u

ROOT="${1:-}"
if [[ -z "$ROOT" || ! -d "$ROOT" ]]; then
  echo "UNKNOWN: pass Joomla webroot as arg 1" >&2
  exit 2
fi

MANIFEST="$ROOT/administrator/components/com_baforms/baforms.xml"
ALT="$(find "$ROOT" -type f -name 'baforms.xml' 2>/dev/null | head -n1 || true)"
[[ -f "$MANIFEST" ]] || MANIFEST="$ALT"

if [[ -z "$MANIFEST" || ! -f "$MANIFEST" ]]; then
  echo "UNKNOWN: Balbooa Forms not found under $ROOT"
  exit 2
fi

VER=$(grep -oE '<version>[^<]+' "$MANIFEST" | head -n1 | sed 's/<version>//')
if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not parse version from $MANIFEST"
  exit 2
fi

FIXED="2.4.1"
# semver compare: is $VER < $FIXED?
lt() { [ "$1" = "$2" ] && return 1; [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]; }

if lt "$VER" "$FIXED"; then
  STATUS="VULNERABLE"
  RC=1
else
  STATUS="PATCHED"
  RC=0
fi

echo "Balbooa Forms version: $VER  (fixed: $FIXED)"
echo "Manifest: $MANIFEST"
echo "Status: $STATUS"

# Optional live probe for stray webshells in common Balbooa upload dirs
for d in "$ROOT/images/baforms" "$ROOT/media/com_baforms/uploads" "$ROOT/images/com_baforms"; do
  if [[ -d "$d" ]]; then
    HITS=$(find "$d" -type f \( -iname '*.php*' -o -iname '*.phtml' -o -iname '*.phar' -o -iname '*.pht' -o -iname '*.inc' \) 2>/dev/null)
    if [[ -n "$HITS" ]]; then
      echo "WARNING: executable files present in upload dir $d:"
      echo "$HITS"
      RC=1
    fi
  fi
done

exit $RC

Sources

1. mySites.guru — Balbooa Forms RCE (CVE-2026-56291)
2. SecurityAffairs — CISA adds iCagenda and Balbooa Forms to KEV
3. NVD — CVE-2026-56291
4. CIRCL Vulnerability-Lookup — CVE-2026-56291
5. THREATINT — CVE-2026-56291
6. Balbooa Joomla Forms Changelog
7. Joomla Extensions Directory — Balbooa Forms
8. CISA KEV Catalog