CVE-2026-56291

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 25, 2026

Description

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
balbooa.com	balbooa.com Balbooa Forms extension for Joomla	1.0-2.4.0

References

https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/Exploit, Third Party Advisory
https://www.balbooa.com/joomla-formsProduct
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56291US Government Resource

Timeline

Published: Jul 9, 2026
Last modified: Oct 25, 2026
Added to CISA KEV: Jul 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-562927.5Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 CVE-2026-562935.4Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org when transferring appli CVE-2026-562944.8capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fail CVE-2026-562956.3Capgo before 12.128.2 contains an authorization bypass vulnerability in webhook management endpoints that allows non-expiring API keys to by CVE-2026-562965.3Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transfer_app RPC function that returns distinct error CVE-2026-562978.1FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchroniza CVE-2026-562984.3Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation dat CVE-2026-562995.3Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated att CVE-2026-56304.3A flaw has been found in assafelovic gpt-researcher up to 3.4.3. The impacted element is an unknown function of the file backend/server/app.CVE-2026-563007.5Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key va CVE-2026-563015.5Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to CVE-2026-563026.5Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to rea