Description
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| balbooa.com | balbooa.com Balbooa Forms extension for Joomla | 1.0-2.4.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 5 repositories
-
shinthink/CVE-2026-56291 ★ 2 · Jul 11, 2026
Balbooa Forms (com_baforms) < 2.4.1 — Unauthenticated File Upload to RCE via form.uploadAttachmentFile | CVSS 9.8 | CISA KEV
-
0xdenis77/CVE-2026-56291 ★ 1 · Jul 13, 2026
Mendeteksi versi (passive detection) & Exploitation CVE POC
-
theendofabbys/CVE-2026-56291 ★ 0 · Oct 8, 2026
-
ChiefYoru/CVE-2026-56291_PoC ★ 0 · Jul 18, 2026
The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
-
rimbadirgantara/CVE-2026-56291.yaml ★ 0 · Jul 13, 2026
nuclei template for CVE-2026-56291
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload http/cves/2026/CVE-2026-56291.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://www.balbooa.com/joomla-forms product
- https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/ third-party-advisory