All vulnerabilities
CVE-2026-101126

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4

balbooa.com Balbooa Forms extension for JoomlaApplications & CMS
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published29 Sep 2026Updated 1 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming, metadata tampering, and path traversal risks (e.g., via getFilePath())

Text from CVE List

Affected versions 1

  • Balbooa Forms extension for Joomlaaffected: 1.0.0-2.4.3.3CVE List

References 1