---
title: "Balbooa Forms CVE-2026-56291: Exploited Joomla Upload RCE"
url: https://erroneo.us/security/briefs/balbooa-forms-joomla-file-upload-cve-2026-56291/
description: "Unauthenticated PHP upload in the Balbooa Forms Joomla extension (2.4.0 and older), exploited and in KEV. Later pre-auth bugs too: update to 2.4.3.4+."
type: security-brief
section: "Security Digest"
date_published: 2026-07-09
date_modified: 2026-09-29
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-56291"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Balbooa Forms CVE-2026-56291: Exploited Joomla Upload RCE

**Verdict: Check exposure.** Only Joomla sites running Balbooa Forms are at risk, but for them this is an emergency: an unauthenticated web-shell upload exploited before the patch, followed by more pre-auth bugs, so update to 2.4.3.4 or later and hunt for shells.

- **Who must act:** Anyone who runs or maintains Joomla sites with the Balbooa Forms extension (com_baforms), including agencies looking after many client sites.
- **Who can relax:** Sites that do not use Joomla, and Joomla sites without Balbooa Forms installed.
- **Affected:** Balbooa Forms 1.0 through 2.4.0 (CVE-2026-56291); Balbooa Forms through 2.4.3.1 (later pre-auth flaws CVE-2026-67364 and CVE-2026-67363)
- **Fixed:** Balbooa Forms 2.4.1 (CVE-2026-56291); Balbooa Forms 2.4.3.2 (CVE-2026-65880, CVE-2026-67364, CVE-2026-67363); Balbooa Forms 2.4.3.4 (current minimum recommended by mySites.guru)
- **CVEs:** CVE-2026-56291
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every Joomla site and check whether Balbooa Forms (com_baforms) is installed and at which version.
2. Update Balbooa Forms to 2.4.3.4 or later; 2.4.1 fixes only this CVE and leaves later pre-auth bugs open.
3. If you cannot update today, unpublish public forms that accept file attachments or disable the extension.
4. Search images/baforms/uploads/ for .php files and remove PHP execution rights from upload directories.
5. Review Joomla administrator accounts and recently modified PHP files; if you find a shell, restore from a clean backup and rotate credentials.

### How to check if you are affected

- Run find images/baforms/uploads -name '*.php' -type f from the Joomla root; any hit is a red flag.
- Search web server access logs for POST requests containing option=com_baforms and task=form.uploadAttachmentFile.
- List Joomla users sorted by registration date and look for administrator accounts you did not create.
- Look for recently modified or unfamiliar PHP files anywhere in the web root.

## What happened

On July 9, 2026, the Joomla CNA published [CVE-2026-56291](https://www.cve.org/CVERecord?id=CVE-2026-56291), an unauthenticated arbitrary file upload (CWE-434) in Balbooa Forms. The extension, also called `com_baforms`, is a drag-and-drop form builder for [Joomla 4 and 5](https://www.balbooa.com/joomla-forms). The CNA scores it CVSS 4.0 10.0, with exploit maturity set to "Attacked."

Phil Taylor of [mySites.guru](https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/) found the bug by working backward from a real compromise. A Hetzner abuse report about a live Joomla site led a customer to hand over a web server access log. The log showed a POST to the Forms attachment handler that should never have succeeded.

According to his write-up, the handler (`index.php?option=com_baforms&task=form.uploadAttachmentFile`) had no login check, no CSRF token check and no extension allow-list. `File::makeSafe()` cleaned the filename, but the visitor's original extension was put back afterward. A `.php` upload therefore stayed `.php`. It landed in `images/baforms/uploads/form-<id>/`, inside the web root, where PHP runs. Balbooa answered the private report the same day and shipped 2.4.1 on July 9. CISA added the CVE to its [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56291) on July 10, giving federal agencies until July 13.

## Who is affected

Balbooa Forms 1.0 through 2.4.0 have this upload flaw. The extension's trouble did not stop at 2.4.1, though:

- [CVE-2026-65880](https://www.cve.org/CVERecord?id=CVE-2026-65880) is an unauthenticated RCE through forms that use the signature field. It was published July 28 and fixed in 2.4.3.
- [CVE-2026-67364](https://www.cve.org/CVERecord?id=CVE-2026-67364) is a pre-auth PHP code injection. A query parameter flows unescaped into the optional custom-PHP handler, which runs it through `eval()`.
- [CVE-2026-67363](https://www.cve.org/CVERecord?id=CVE-2026-67363) lets anyone set the charge amount, because the `stripeCharges` and `payAuthorize` endpoints trust a client-supplied total.

The last two cover versions through 2.4.3.1 and were published August 19, after 2.4.3.2 shipped. mySites.guru now calls 2.4.3.4, released September 29 with five more security fixes, the minimum safe version. Among the installs its platform can see, it reports that roughly one in four were still on 2.4.2.1 or older. CISA's enrichment marked the later three CVEs as not known to be exploited when they were published. Only CVE-2026-56291 is in KEV.

## Do you really need to act?

Only if you run Joomla with Balbooa Forms. If you do, treat this as an emergency. The upload needs no account and no user interaction, and the CNA marks it automatable. It was being exploited before a fix existed, and mySites.guru reported that attacks were continuing. A successful upload is a web shell: the attacker can read `configuration.php`, take over the database and pivot into anything else on the host.

Agencies and freelancers who maintain many client sites are the most exposed group, because forgotten installs rarely get extension updates. WordPress, Drupal and non-PHP stacks are not affected. Joomla sites without this extension can relax.

## What to do now

1. Inventory. In each Joomla admin, open System, then Manage, then Extensions, and search for Balbooa Forms. On disk, look for `administrator/components/com_baforms` and read the `<version>` tag in its XML manifest.
2. Update to 2.4.3.4 or later. Do not stop at 2.4.1, which leaves the later pre-auth bugs open.
3. If an update has to wait, unpublish public forms that accept file attachments, as mySites.guru advises, or disable the extension.
4. As hardening, deny PHP execution under `images/` in your Apache or nginx configuration, so a future upload bug cannot become code execution.
5. If you find a shell, restore from a known-clean backup. Then rotate the database password in `configuration.php` and all administrator passwords, and patch before bringing the site back.

## How to tell if you were hit

From the Joomla root, run `find images/baforms/uploads -name '*.php' -type f`. Legitimate attachments are not PHP, so any hit means compromise. Search access logs for POST requests containing `com_baforms` and `uploadAttachmentFile`, especially from before you updated. In Joomla Users, sort by registration date and check for administrators you do not recognize. Then look for recently modified or unfamiliar PHP files across the web root. mySites.guru did not publish attacker filenames or IP addresses, so there is no indicator list as of October 21, 2026.

## Timeline

- Jul 8, 2026 — mySites.guru receives a customer's access log, reproduces the flaw and reports it privately to Balbooa, which replies the same day.
- Jul 9, 2026 — Balbooa Forms 2.4.1 is released, and the Joomla CNA publishes CVE-2026-56291.
- Jul 10, 2026 — CISA adds the CVE to KEV, with a July 13 deadline.
- Jul 28, 2026 — Version 2.4.3 fixes CVE-2026-65880, the signature-field RCE.
- Aug 19, 2026 — CVE-2026-67364 and CVE-2026-67363 are published, both fixed in 2.4.3.2.
- Sep 29, 2026 — Version 2.4.3.4 ships five more security fixes, and mySites.guru names it the new minimum.

## Sources

1. [mySites.guru — Balbooa Forms unauthenticated file upload flaw (CVE-2026-56291)](https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/)
2. [CVE record — CVE-2026-56291](https://www.cve.org/CVERecord?id=CVE-2026-56291)
3. [NVD — CVE-2026-56291](https://nvd.nist.gov/vuln/detail/CVE-2026-56291)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-56291](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56291)
5. [Balbooa — Joomla Forms product page](https://www.balbooa.com/joomla-forms)
6. [CVE record — CVE-2026-65880 (Balbooa Forms signature field RCE)](https://www.cve.org/CVERecord?id=CVE-2026-65880)
7. [CVE record — CVE-2026-67364 (Balbooa Forms pre-auth PHP code injection)](https://www.cve.org/CVERecord?id=CVE-2026-67364)
8. [CVE record — CVE-2026-67363 (Balbooa Forms payment amount tampering)](https://www.cve.org/CVERecord?id=CVE-2026-67363)

---
Source page: https://erroneo.us/security/briefs/balbooa-forms-joomla-file-upload-cve-2026-56291/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt