CVE-2026-101127
Balbooa Forms: cross-site scripting
- Risk score
- 66/100
- CVSS
- 9.4 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in #__baforms_submissions_attachments.name. A la…
- Affected
- Balbooa Forms
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Balbooa Forms: Amber, patch this week. Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling eval(), the component replaces…
The flaws
- CVE-2026-101127: Cross-site scripting (CVSS 9.4 · EPSS 0%)
- CVE-2026-102425: Code injection (CVSS 10.0 · EPSS 0%)
- CVE-2026-102424: Path traversal (CVSS 7.5 · EPSS 0%)
- CVE-2026-101126: Path traversal (CVSS 6.5 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Balbooa Forms
Where it stands
- No known exploitation
Connects to
- Same weakness: Cross-site scripting (CWE-79). 399 other warnings in 30 days
- Same product: Earlier Balbooa Forms warnings. 1 in the last 90 days
Why it is Amber
- CVSS 9.4 critical
- Remotely exploitable without logging in
References
Original description
Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in `#__baforms_submissions_attachments.name`. A later anonymous form submission associates that temporary attachment with the newly created submission. When an administrator opens the submission, the component's JavaScript retrieves the stored attachment record and concatenates `file.name` directly into an HTML string. The complete string is assigned to `innerHTML`.
Last activity 29 Sep 2026. Patch Forecast updates every hour.