CVE-2026-102424
Balbooa Forms: path traversal
- Risk score
- 56/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose id merely looks numeric, the component trusts the s…
- Affected
- Balbooa Forms
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Balbooa Forms: Amber, patch this week. Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling eval(), the component replaces…
The flaws
- CVE-2026-102424: Path traversal (CVSS 7.5 · EPSS 0%)
- CVE-2026-102425: Code injection (CVSS 10.0 · EPSS 0%)
- CVE-2026-101127: Cross-site scripting (CVSS 9.4 · EPSS 0%)
- CVE-2026-101126: Path traversal (CVSS 6.5 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Balbooa Forms
Where it stands
- No known exploitation
Connects to
- Same weakness: Path traversal (CWE-22). 398 other warnings in 30 days
- Same product: Earlier Balbooa Forms warnings. 1 in the last 90 days
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose `id` merely looks numeric, the component trusts the supplied `filename`, concatenates it below the configured upload directory, and adds the result to an array of local attachment paths. It does not load the referenced attachment row, verify ownership/session/form/field, require that the ID exists, canonicalize the path, or enforce containment. If the form's normal “auto reply” and “attach uploaded files” options are enabled, the component sends those local paths as email attachments to the address submitted in an email field. A Guest can therefore submit a nonexistent numeric ID plus a traversal filename such as `../../../../configuration.php` and receive any file readable by the Joomla process.
Last activity 29 Sep 2026. Patch Forecast updates every hour.