A critical unauthenticated file upload vulnerability in the Balbooa Forms extension for Joomla permits full remote code execution on the underlying server.

The extension fails to restrict file types during upload, allowing unauthenticated attackers to upload malicious executable files directly to the server.

With a CVSS score of 10.0, this vulnerability represents the highest level of risk. An attacker gaining remote code execution can fully compromise the web server, pivot to internal networks, install backdoors, or exfiltrate sensitive site data, leading to total system compromise and severe reputational damage.

Immediate Action: Update the Balbooa Forms extension to the latest available version provided by the vendor.

Proactive Monitoring: Review the web server's upload directory for suspicious files (e.g., .php files in media or upload folders) and monitor for unauthorized process execution.

Compensating Controls: Restrict access to upload directories using server-level configuration (e.g., .htaccess or Nginx rules) to prevent the execution of scripts within those paths.

Public Exploit Available: False

Given the critical nature of this RCE vulnerability and its potential for unauthenticated exploitation, immediate remediation is mandatory. Administrators must ensure the extension is updated and perform a thorough security audit of the server to ensure no malicious files have already been introduced.