CVE-2026-56291

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-56291 9.8

Balbooa · Forms · Added 2026-07-10 · Published 2026-07-09

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityBalbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability

VendorBalbooa

ProductForms

Date added2026-07-10

Due date2026-07-13

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-434

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.

NVD: The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-25 23:47 UTC

Wall time0.5s

Searches5

Component defaultunknown

Sources https://nvd.nist.gov/vuln/detail/CVE-2026-56291
https://www.balbooa.com/help/joomla-forms-documentation/basics/changelog
https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/
https://www.cve.org/CVERecord?id=CVE-2026-56291
https://www.cisa.gov/news-events/alerts/2026/07/10/cisa-adds-two-known-exploited-vulnerabilities-catalog
https://github.com/shinthink/CVE-2026-56291
https://www.hivepro.com/threat-advisory/cve-2026-56291-balbooa-forms-file-upload-flaw-actively-exploited
https://github.com/advisories/ghsa-28f5-j5p5-xmmw

Hunting hypothesis agent

Hunt for POST /index.php?*task=form.uploadAttachmentFile with form_id=1-10 — PoC uploads PHP shell to images/baforms/uploads/form-{id}/ via multipart then GETs it for RCE; stock logs omit body, monitor uploads/ for .php/.phtml files.

Research details

Componentcom_baforms FormModel::uploadAttachmentFile frontend task — unauthenticated multipart POST to /index.php?option=com_baforms&task=form.uploadAttachmentFile accepts attacker-supplied filename and extension without CSRF token, permission check, or file-type whitelist

PreconditionsNetwork access (HTTP/HTTPS) to a Joomla site with Balbooa Forms (com_baforms) extension installed and enabled; no authentication required; target must run Balbooa Forms version 1.0 through 2.4.0 (patched in 2.4.1). The attacker needs to know or guess a valid form_id (brute-force range 1–10 is trivial). agent

DeliveryNetwork (HTTP/HTTPS to Joomla site); unauthenticated multipart POST to /index.php?option=com_baforms&task=form.uploadAttachmentFile with form_id parameter and PHP file payload saves a webshell to images/baforms/uploads/form-{id}/, accessible directly via URL for RCE.

Public PoCyes

PoC URLs https://github.com/shinthink/CVE-2026-56291 Third-party repos; verify before use.

Advisoryhttps://www.balbooa.com/help/joomla-forms-documentation/basics/changelog

Exploit notesThe shinthink/CVE-2026-56291 GitHub repo (2 stars) provides a full mass-exploitation Python tool (307 lines). The exploit POSTs a multipart file to /index.php?option=com_baforms&task=form.uploadAttachmentFile&form_id={id}&format=json with name and ext fields set to a PHP filename; the server saves it directly to images/baforms/uploads/form-{id}/ without extension filtering. The PoC deploys a PHP shell (<?php system($_GET['c']); ?>) and verifies RCE via ?c=id. FormModel::uploadAttachmentFile at ~L122 of frontend/models/forms/FormModel.php performs no Session::checkToken(), no permission check, and no file extension whitelist. The attacker's extension is used directly: $fileName = $name . '.' . $ext. FOFA/Shodan dorks: body="com_baforms" or http.html:"baforms". Actively exploited since before CISA KEV addition on July 10, 2026. CVSS attack complexity: LOW | CRITICAL severity (CVSS 9.8).

SummaryBalbooa Forms (com_baforms) for Joomla versions 1.0 through 2.4.0 contains a critical unauthenticated arbitrary file upload vulnerability (CWE-434) in the FormModel::uploadAttachmentFile frontend task. The upload endpoint at /index.php?option=com_baforms&task=form.uploadAttachmentFile accepts multipart POST requests without a CSRF token, permission check, or file extension whitelist. Uploaded files are saved to images/baforms/uploads/form-{id}/ using the attacker-controlled filename and extension directly, allowing PHP webshell deployment and full remote code execution. A mass-exploitation Python tool is publicly available on GitHub. The vulnerability is actively exploited in the wild and was added to CISA KEV on July 10, 2026.

Tia coverage

First reported2026-07-12

First exploit report2026-07-13

Exploit report → KEV3 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-kev-two-new-joomla-extension-entries-added-july-10-icagenda two-cvss-10-joomla-extensions-under-active-zero-day-exploitation

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.