CVE-2026-56291

critical

Description

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

References

Exploits
More

https://latesthackingnews.com/2026/07/15/joomla-file-upload-vulnerabilities/

https://www.theregister.com/security/2026/07/14/baddies-caught-exploiting-extensions-bugs-with-perfect-10-scores-on-vulnerable-joomla-websites/5271001

https://www.securityweek.com/organizations-warned-of-exploited-joomla-extension-vulnerabilities/

https://www.bleepingcomputer.com/news/security/cisa-warns-of-actively-exploited-rce-flaws-in-joomla-extensions/

https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html

https://securityaffairs.com/195164/security/u-s-cisa-adds-icagenda-and-balbooa-forms-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://www.cisa.gov/news-events/alerts/2026/07/10/cisa-adds-two-known-exploited-vulnerabilities-catalog

https://github.com/theendofabbys/CVE-2026-56291

https://github.com/rimbadirgantara/CVE-2026-56291.yaml

https://github.com/zulfianarahmi/cve-dashboard

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56291

https://www.balbooa.com/joomla-forms

https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42573

Details

Source: Mitre, NVD

Published: 2026-07-09

Updated: 2026-10-25

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 10

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Severity: Critical

EPSS

EPSS: 0.14854