CVE-2026-56291: Balbooa Forms -- Unauthenticated File Upload RCE in Joomla

Background

Balbooa Forms is a commercial form builder extension for Joomla with tens of thousands of active installations. It provides drag-and-drop form creation with file upload fields — a feature that, in versions up to and including 2.4.0, was completely unguarded against malicious file types.

CVE-2026-56291 was discovered by Phil Taylor of mySites.guru during an incident investigation. The vulnerability was being actively exploited in the wild before any public disclosure or patch was available. Exploitation was traced to IP addresses on Hetzner-hosted infrastructure, suggesting organised rather than opportunistic abuse. Balbooa released version 2.4.1 on July 9, 2026. CISA added the CVE to its Known Exploited Vulnerabilities catalogue with a federal remediation due date of July 13, 2026.

Technical Mechanism

The vulnerability resides in the attachment file upload endpoint used by Balbooa Forms when processing form submissions. The endpoint is reachable without authentication or CSRF verification:

POST /index.php?option=com_baforms&task=form.uploadAttachmentFile

In affected versions, the component performed no validation of the uploaded file’s extension or MIME type. An attacker could POST a PHP webshell directly to this endpoint, and the file would be written to a directory within the web root:

/images/baforms/uploads/<original-filename>

Because the file retains its original filename and extension, and because images/baforms/uploads/ is publicly accessible under the web root, a PHP file placed here is immediately executable by the web server.

The attack chain is three steps:

1. POST a PHP webshell to com_baforms&task=form.uploadAttachmentFile (no auth, no CSRF token required)
2. Server writes the file to /images/baforms/uploads/shell.php
3. Issue a GET request to /images/baforms/uploads/shell.php?cmd=whoami — the web server executes the PHP and returns command output

The absence of authentication check, CSRF protection, extension filtering, and MIME type inspection all must fail simultaneously for this to be exploitable — and in pre-2.4.1 versions, all four checks were missing.

Version 2.4.1 introduced:

• An extension allowlist (only permitted upload types accepted)
• MIME type verification against the allowlist
• Server-generated randomised filenames to prevent direct targeting by extension
• CSRF token requirement on the upload endpoint

Real-World Exploitation Evidence

Exploitation of CVE-2026-56291 was observed before the patch was available, making this a zero-day at time of discovery. Indicators from the incident that surfaced the vulnerability:

• POST requests to com_baforms&task=form.uploadAttachmentFile from external IPs with no preceding form interaction
• Uploaded files with .php extensions in /images/baforms/uploads/
• Subsequent GET requests to the uploaded paths within seconds of upload, consistent with automated exploit chaining
• Source IPs resolving to Hetzner-hosted VPS infrastructure, a common choice for exploitation infrastructure due to fast provisioning

The exploit appears to have been included in scanning tooling, as the pattern of requests (upload attempt followed immediately by execution probe) was consistent across multiple victim sites.

Impact Assessment

Successful exploitation gives the attacker web shell access running as the web server user (typically www-data on Linux). From that position:

• Arbitrary command execution on the server
• Database access: Joomla’s configuration.php contains database credentials in plaintext; a webshell can read this file and exfiltrate credentials
• File system access: All files readable by the web server user, including other site configurations, uploaded content, and potentially SSH keys in adjacent directories
• Persistence: Secondary backdoors can be installed; the initial webshell is trivial to replace or supplement
• Lateral movement: In shared hosting environments, misconfigurations may allow access to other sites on the same server

The unauthenticated nature of the attack removes any dependency on obtaining credentials or social engineering site users — any Joomla installation with Balbooa Forms ≤ 2.4.0 installed and the component enabled is vulnerable to a fully automated exploit.

Affected Versions

Remediation Steps

1. Update to version 2.4.1 immediately. The patch is available through the Joomla Extension Manager or from Balbooa directly. This is the only complete fix.

2. Search for existing webshells. Before and after patching, check /images/baforms/uploads/ for PHP files that should not be there. Automated scans for known webshell patterns should also cover the full web root.

3. Review web server access logs. Search for POST requests to com_baforms&task=form.uploadAttachmentFile from unexpected IPs, particularly those not associated with your users. Follow up with GET requests to /images/baforms/uploads/ for PHP files.

4. Consider whether the component was active during the exposure window. If Balbooa Forms was installed and enabled on a public-facing Joomla site for any period before July 9, 2026, treat it as a potential compromise and investigate accordingly.

5. Rotate database credentials. Even if webshell activity is not confirmed, rotate the Joomla database credentials in configuration.php if there is any possibility the server was accessed.

6. Mitigation if patching is delayed: Disable the Balbooa Forms component in Joomla’s extension manager until the patch can be applied. This removes the vulnerable endpoint from the attack surface.

Detection Guidance

Log-based indicators:

# Grep web server access log for upload attempts
grep "com_baforms.*uploadAttachmentFile" /var/log/apache2/access.log
grep "com_baforms.*uploadAttachmentFile" /var/log/nginx/access.log

# Grep for requests to uploads directory for PHP files
grep "images/baforms/uploads/.*\.php" /var/log/apache2/access.log

File system check:

# Find PHP files in Balbooa uploads directory
find /path/to/joomla/images/baforms/uploads/ -name "*.php" -o -name "*.phtml" -o -name "*.php7"

# Find recently modified PHP files across web root (last 30 days)
find /path/to/joomla/ -name "*.php" -newer /path/to/joomla/configuration.php -not -path "*/cache/*"

WAF rule (ModSecurity):

SecRule REQUEST_URI "@contains com_baforms" \
    "id:9002601,phase:2,deny,status:403,\
    msg:'Balbooa Forms upload endpoint blocked',\
    chain"
SecRule REQUEST_URI "@contains uploadAttachmentFile" ""

Timeline

References

• NVD — CVE-2026-56291
• CISA KEV — CVE-2026-56291
• Balbooa Forms Changelog