CVE-2026-56291

Balbooa · Balbooa Forms extension for Joomla

An unauthenticated arbitrary file upload vulnerability in the Balbooa Forms extension for Joomla allows attackers to upload executable files, leading to full remote code execution.

Executive summary

A critical unauthenticated file upload vulnerability in the Balbooa Forms extension for Joomla permits full remote code execution on the underlying server.

Vulnerability

The extension fails to restrict file types during upload, allowing unauthenticated attackers to upload malicious executable files directly to the server.

Business impact

With a CVSS score of 10.0, this vulnerability represents the highest level of risk. An attacker gaining remote code execution can fully compromise the web server, pivot to internal networks, install backdoors, or exfiltrate sensitive site data, leading to total system compromise and severe reputational damage.

Remediation

Immediate Action: Update the Balbooa Forms extension to the latest available version provided by the vendor.

Proactive Monitoring: Review the web server's upload directory for suspicious files (e.g., .php files in media or upload folders) and monitor for unauthorized process execution.

Compensating Controls: Restrict access to upload directories using server-level configuration (e.g., .htaccess or Nginx rules) to prevent the execution of scripts within those paths.

Exploitation status

Public Exploit Available: False

Analyst recommendation

Given the critical nature of this RCE vulnerability and its potential for unauthenticated exploitation, immediate remediation is mandatory. Administrators must ensure the extension is updated and perform a thorough security audit of the server to ensure no malicious files have already been introduced.

Deep Dive #9

Am I vulnerable, and what should I do?

Operational write-up published 2026-07-13. Detection rules are starter content — validate before deploying.

Am I vulnerable?

CVE-2026-56291 affects the Balbooa Forms extension for Joomla (component element com_baforms). Any site running a vulnerable build with a public form that accepts file attachments exposes an unauthenticated upload endpoint — no login, no CSRF token, and no valid file-type check stand between an attacker and code execution.

Affected versions

Product	Vulnerable range	Fixed in
Balbooa Forms for Joomla (`com_baforms`)	1.0 through 2.4.0 (inclusive)	2.4.1

Diagnostic checks (read-only)

Run whichever fits your access. "Vulnerable" means version ≤ 2.4.0 with the extension installed and at least one published form accepting attachments.

Joomla admin UI: System → Manage → Extensions, filter for Balbooa Forms (element com_baforms) and read the Version column. 2.4.0 or lower is vulnerable; 2.4.1+ is patched.
Component manifest on disk (Linux): grep -m1 '<version>' /path/to/joomla/administrator/components/com_baforms/baforms.xml. A <version> of 2.4.0 or lower confirms a vulnerable build.
Database (read-only SQL): SELECT name, element, manifest_cache FROM \#__extensions` WHERE element='com_baforms';— replace#__with your table prefix and read theversionfield inside themanifest_cache` JSON.
HTTP presence probe (non-destructive HEAD): curl -I 'https://TARGET/index.php?option=com_baforms&view=form'. A 200/302 (not 404) indicates the component is present and routable; confirm the version with one of the methods above.
Post-compromise triage: find /path/to/joomla/images/baforms/uploads/ -type f $ -name '*.php' -o -name '*.phtml' -o -name '*.phar' $ -printf '%Tc %p\n'. Legitimate attachments are not scripts — any executable file in this tree is a strong indicator of exploitation.

Vulnerability

This is a textbook CWE-434 (Unrestricted Upload of File with Dangerous Type). The extension's frontend attachment handler — reachable at index.php?option=com_baforms&task=form.uploadAttachmentFile — accepts anonymous uploads with no authentication, no CSRF token, and no server-side extension allow-list. An attacker uploads a file the server will execute as code (in practice a PHP web shell) and it lands in the web-accessible images/baforms/uploads/form-<id>/ path, where PHP execution is enabled by default. The attacker then requests that file directly, and the web server runs it.

Because the primitive is a direct-to-disk write of an executable file in a public path, there is no memory-corruption fragility or exploit reliability problem to solve: the request either succeeds or 404s. That is what pushes it to the ceiling of the severity scale — NVD scores it CVSS v4.0 10.0 (CVSS v3.1 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The unauthenticated, network-reachable, no-interaction shape (AV:N + PR:N + UI:N) is exactly the profile that commodity mass-scanning tooling weaponizes within hours of disclosure. mySites.guru, which discovered the flaw during response to a live customer attack on 2026-07-08, traced the root cause to the missing allow-list and CSRF check on that single handler.

Threat model

Who would exploit this: The most likely operators are opportunistic criminal mass-scanners and initial-access brokers who fingerprint internet-facing Joomla sites for the Balbooa Forms extension and fire a single unauthenticated upload request at scale. The barrier to entry is near zero — no login, no CSRF token, no user interaction — and CISA has confirmed active in-the-wild exploitation as a zero-day. State-aligned use is plausible but unproven; commodity CMS mass-compromise is the dominant pattern for flaws of this shape.

What they're after:

Drop a PHP web shell to establish a persistent foothold on the web server
Resell initial access (broker the compromised host to other criminal buyers)
Inject SEO spam or deface the hosted site
Deploy a cryptominer on the web-server host
Stage ransomware / extortion from the foothold
Exfiltrate site and database contents (including configuration.php credentials and visitor data)

Attack chain: The attacker mass-scans for Joomla sites running a vulnerable Balbooa Forms version, then sends a single unauthenticated request to the frontend attachment-upload endpoint, which writes an attacker-supplied PHP file into the public uploads folder. The attacker requests that file directly to gain code execution as the web-server user. From there they typically install a web shell for persistence and use it to read credentials or create a hidden Joomla Super User.

Blast radius: Code execution as the web-server user typically exposes configuration.php, which holds the Joomla database credentials and admin secrets — enabling full site takeover and a hidden Super User. On shared or multi-tenant hosting the same account often reaches adjacent virtual hosts and other sites under the hosting account, and the foothold can serve as a pivot toward the internal network. Site visitor and form-submission data is directly at risk.

Mitigation

Patch

Upgrade to Balbooa Forms 2.4.1 (released 2026-07-09) immediately — do not wait for a maintenance window. The fix adds a server-side extension allow-list, a MIME-type content check, server-generated filenames, and a CSRF token check on the frontend upload handler.

Product	Fixed version	Notes
Balbooa Forms for Joomla (`com_baforms`)	2.4.1	Released 2026-07-09; closes the unauthenticated upload path

Compensating controls

If you cannot patch within the hour, apply defense-in-depth while you schedule the upgrade:

Take the endpoint out of reach: unpublish every public Balbooa Forms form that accepts file attachments. This disables the vulnerable form.uploadAttachmentFile handler until 2.4.1 is applied — the vendor's own recommended interim workaround.
Deny script execution in the upload tree. The uploads directory should never run PHP. Drop the following into images/baforms/uploads/.htaccess (Apache) as general hardening — validate against your server config before deploying:
```
# Disable script execution in the Balbooa Forms upload directory
<FilesMatch "\.(php|phtml|php[0-9]|phar|pht)$">
    Require all denied
</FilesMatch>
php_flag engine off
```
Nginx equivalent (inside the relevant server block):
```
location ^~ /images/baforms/uploads/ {
    location ~ \.(php|phtml|php[0-9]|phar|pht)$ { deny all; }
}
```
Segment and least-privilege: ensure the web-server user cannot reach adjacent tenants or write outside its document root, and audit for unauthorized Joomla administrator accounts created after 2026-07-08.

Detection (starter rules — validate before deploying)

These rules are AI-generated starter content. Test against your own telemetry and tune falsepositives before deploying to production.

Network and log signals

HTTP POST requests to the Balbooa Forms upload handler (option=com_baforms with task=form.uploadAttachmentFile) carrying Content-Type: multipart/form-data and a filename ending in .php, .phtml, .php5, .phar, .pht, or a double extension such as .php.jpg — from an unauthenticated session (no prior Joomla login event).
Creation of new .php/.phtml/.phar files under images/baforms/uploads/ (or other web-accessible upload/media dirs), owned by the web-server user, with a modification time immediately following a POST to the upload endpoint.
Subsequent GET/POST requests to a newly-created .php file inside an upload directory — a path never referenced by the application's own templates — often with cmd=, c=, x=, pass=, or base64/eval-style query parameters, frequently from the same source IP that performed the upload.
Web-server user (www-data/apache/nginx) spawning shell or recon processes (sh -c, bash -i, whoami, id, uname -a, wget, curl, nc) with a PHP-FPM/Apache worker as the parent process.
Automated-exploitation fingerprints: non-browser User-Agent (curl/python-requests/Go-http-client), absent Referer, and requests hitting the upload API without first fetching the form page; plus outbound reverse-shell connections from the web host shortly after an upload.

YARA

rule CVE_2026_56291_starter_php_webshell
{
    meta:
        author = "CVE Brief - AI-generated starter rule"
        description = "Generic PHP webshell dropped into a Joomla/Balbooa Forms upload directory (CVE-2026-56291 unauth arbitrary file upload -> RCE). Validate in your environment before deploying."
        reference = "CVE-2026-56291"
        date = "2026-07-13"
        confidence = "medium"

    strings:
        $php_open = "<?php" ascii nocase
        $php_short = "<?=" ascii

        // Command/code execution sinks commonly present in webshells
        $exec1 = "eval(" ascii nocase
        $exec2 = "assert(" ascii nocase
        $exec3 = "system(" ascii nocase
        $exec4 = "shell_exec(" ascii nocase
        $exec5 = "passthru(" ascii nocase
        $exec6 = "proc_open(" ascii nocase
        $exec7 = "popen(" ascii nocase
        $exec8 = "pcntl_exec(" ascii nocase
        $exec9 = "preg_replace" ascii nocase   // /e modifier abuse

        // Attacker-controlled input pulled straight into the sink
        $input1 = "$_POST[" ascii
        $input2 = "$_GET[" ascii
        $input3 = "$_REQUEST[" ascii
        $input4 = "$_COOKIE[" ascii
        $input5 = "php://input" ascii nocase

        // Obfuscation / dynamic-call patterns typical of dropped shells
        $obf1 = "base64_decode(" ascii nocase
        $obf2 = "gzinflate(" ascii nocase
        $obf3 = "str_rot13(" ascii nocase
        $obf4 = "create_function(" ascii nocase
        $obf5 = "call_user_func(" ascii nocase
        $obf6 = /\$[a-zA-Z_]\w*\s*\(\s*\$_(POST|GET|REQUEST|COOKIE)/ ascii  // $var($_POST[..])

        // Common commodity-shell fingerprints
        $tag1 = "c99" ascii nocase
        $tag2 = "r57" ascii nocase
        $tag3 = "WSO " ascii nocase
        $tag4 = "FilesMan" ascii nocase
        $tag5 = "b374k" ascii nocase

    condition:
        filesize < 500KB
        and any of ($php_open, $php_short)
        and (
            ( any of ($exec*) and ( any of ($input*) or any of ($obf*) ) )
            or any of ($tag*)
        )
}

Sigma

title: Balbooa Forms (Joomla) Unauth Upload Followed by Webshell Execution (CVE-2026-56291)
id: 3f2a9c74-7b1e-4d68-9a2c-1e5f0b6d84a1
status: experimental
description: >
  Detects likely exploitation of CVE-2026-56291, an unauthenticated arbitrary
  file upload in the Balbooa Forms extension for Joomla leading to RCE. Fires on
  webserver/proxy logs showing a POST to the Balbooa Forms component upload path,
  or a request that executes a PHP file living under a web-accessible upload/media
  directory. AI-generated starter rule - validate in your environment before deploying.
author: CVE Brief - AI-generated starter rule
date: 2026/07/13
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-56291
logsource:
  category: webserver
detection:
  upload_endpoint:
    cs-uri-query|contains:
      - 'option=com_baforms'
    cs-uri-query|contains|all:
      - 'task=form.uploadAttachmentFile'
    cs-method: 'POST'
  webshell_path:
    cs-uri-stem|contains:
      - '/images/baforms/uploads/'
      - '/images/'
      - '/media/'
      - '/tmp/'
    cs-uri-stem|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.phar'
      - '.pht'
  webshell_params:
    cs-uri-query|contains:
      - 'cmd='
      - 'exec='
      - 'shell='
      - 'eval='
      - 'passthru='
  condition: upload_endpoint or (webshell_path and webshell_params)
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
  - sc-status
falsepositives:
  - Legitimate administrators or automation deploying PHP files into media/upload paths
  - Security scanners and authorized penetration tests exercising the upload endpoint
  - Applications that legitimately store executable PHP under images/ or media/ (rare - review before excluding)
  - Query parameters named cmd/exec/shell used by unrelated legitimate components
level: high

Rule notes

The Sigma logic keys off two behaviors the exploit chain forces: a POST to the com_baforms form.uploadAttachmentFile endpoint, and execution of a PHP file under the normally non-executable images/baforms/uploads/ tree with shell-style parameters. The YARA rule flags generic PHP web-shell content (input-to-sink patterns, obfuscation, commodity-shell tags) in dropped files. Limitations: these are heuristic and behavioral rather than hash-based; obfuscated or encrypted shells and non-standard query-parameter names will evade the parameter checks, and legitimate PHP under media paths can produce false positives — tune against your own telemetry before deploying.