Balbooa Forms CVE-2026-56291: Exploited Joomla Upload RCE

What to do

1. Inventory every Joomla site and check whether Balbooa Forms (com_baforms) is installed and at which version.
2. Update Balbooa Forms to 2.4.3.4 or later; 2.4.1 fixes only this CVE and leaves later pre-auth bugs open.
3. If you cannot update today, unpublish public forms that accept file attachments or disable the extension.
4. Search images/baforms/uploads/ for .php files and remove PHP execution rights from upload directories.
5. Review Joomla administrator accounts and recently modified PHP files; if you find a shell, restore from a clean backup and rotate credentials.

How to check if you are affected or compromised

• Run find images/baforms/uploads -name '*.php' -type f from the Joomla root; any hit is a red flag.
• Search web server access logs for POST requests containing option=com_baforms and task=form.uploadAttachmentFile.
• List Joomla users sorted by registration date and look for administrator accounts you did not create.
• Look for recently modified or unfamiliar PHP files anywhere in the web root.

What happened#

On July 9, 2026, the Joomla CNA published CVE-2026-56291, an unauthenticated arbitrary file upload (CWE-434) in Balbooa Forms. The extension, also called com_baforms, is a drag-and-drop form builder for Joomla 4 and 5. The CNA scores it CVSS 4.0 10.0, with exploit maturity set to "Attacked."

Phil Taylor of mySites.guru found the bug by working backward from a real compromise. A Hetzner abuse report about a live Joomla site led a customer to hand over a web server access log. The log showed a POST to the Forms attachment handler that should never have succeeded.

According to his write-up, the handler (index.php?option=com_baforms&task=form.uploadAttachmentFile) had no login check, no CSRF token check and no extension allow-list. File::makeSafe() cleaned the filename, but the visitor's original extension was put back afterward. A .php upload therefore stayed .php. It landed in images/baforms/uploads/form-<id>/, inside the web root, where PHP runs. Balbooa answered the private report the same day and shipped 2.4.1 on July 9. CISA added the CVE to its KEV catalog on July 10, giving federal agencies until July 13.

Who is affected#

Balbooa Forms 1.0 through 2.4.0 have this upload flaw. The extension's trouble did not stop at 2.4.1, though:

• CVE-2026-65880 is an unauthenticated RCE through forms that use the signature field. It was published July 28 and fixed in 2.4.3.
• CVE-2026-67364 is a pre-auth PHP code injection. A query parameter flows unescaped into the optional custom-PHP handler, which runs it through eval().
• CVE-2026-67363 lets anyone set the charge amount, because the stripeCharges and payAuthorize endpoints trust a client-supplied total.

The last two cover versions through 2.4.3.1 and were published August 19, after 2.4.3.2 shipped. mySites.guru now calls 2.4.3.4, released September 29 with five more security fixes, the minimum safe version. Among the installs its platform can see, it reports that roughly one in four were still on 2.4.2.1 or older. CISA's enrichment marked the later three CVEs as not known to be exploited when they were published. Only CVE-2026-56291 is in KEV.

Do you really need to act?#

Only if you run Joomla with Balbooa Forms. If you do, treat this as an emergency. The upload needs no account and no user interaction, and the CNA marks it automatable. It was being exploited before a fix existed, and mySites.guru reported that attacks were continuing. A successful upload is a web shell: the attacker can read configuration.php, take over the database and pivot into anything else on the host.

Agencies and freelancers who maintain many client sites are the most exposed group, because forgotten installs rarely get extension updates. WordPress, Drupal and non-PHP stacks are not affected. Joomla sites without this extension can relax.

What to do now#

1. Inventory. In each Joomla admin, open System, then Manage, then Extensions, and search for Balbooa Forms. On disk, look for administrator/components/com_baforms and read the <version> tag in its XML manifest.
2. Update to 2.4.3.4 or later. Do not stop at 2.4.1, which leaves the later pre-auth bugs open.
3. If an update has to wait, unpublish public forms that accept file attachments, as mySites.guru advises, or disable the extension.
4. As hardening, deny PHP execution under images/ in your Apache or nginx configuration, so a future upload bug cannot become code execution.
5. If you find a shell, restore from a known-clean backup. Then rotate the database password in configuration.php and all administrator passwords, and patch before bringing the site back.

How to tell if you were hit#

From the Joomla root, run find images/baforms/uploads -name '*.php' -type f. Legitimate attachments are not PHP, so any hit means compromise. Search access logs for POST requests containing com_baforms and uploadAttachmentFile, especially from before you updated. In Joomla Users, sort by registration date and check for administrators you do not recognize. Then look for recently modified or unfamiliar PHP files across the web root. mySites.guru did not publish attacker filenames or IP addresses, so there is no indicator list as of October 21, 2026.

Timeline#

• Jul 8, 2026 — mySites.guru receives a customer's access log, reproduces the flaw and reports it privately to Balbooa, which replies the same day.
• Jul 9, 2026 — Balbooa Forms 2.4.1 is released, and the Joomla CNA publishes CVE-2026-56291.
• Jul 10, 2026 — CISA adds the CVE to KEV, with a July 13 deadline.
• Jul 28, 2026 — Version 2.4.3 fixes CVE-2026-65880, the signature-field RCE.
• Aug 19, 2026 — CVE-2026-67364 and CVE-2026-67363 are published, both fixed in 2.4.3.2.
• Sep 29, 2026 — Version 2.4.3.4 ships five more security fixes, and mySites.guru names it the new minimum.

Vulnerability records

• CVE-2026-56291 · KEV 2026-07-10 · Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. mySites.guru — Balbooa Forms unauthenticated file upload flaw (CVE-2026-56291) mysites.guru
2. CVE record — CVE-2026-56291 cve.org
3. NVD — CVE-2026-56291 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2026-56291 cisa.gov
5. Balbooa — Joomla Forms product page balbooa.com
6. CVE record — CVE-2026-65880 (Balbooa Forms signature field RCE) cve.org
7. CVE record — CVE-2026-67364 (Balbooa Forms pre-auth PHP code injection) cve.org
8. CVE record — CVE-2026-67363 (Balbooa Forms payment amount tampering) cve.org