CVE-2026-102425
Balbooa Forms: code injection
- Risk score
- 71/100
- CVSS
- 10.0 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling eval(), the component replaces…
- Affected
- Balbooa Forms
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Balbooa Forms: Amber, patch this week. Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling eval(), the component replaces…
The flaws
- CVE-2026-102425: Code injection (CVSS 10.0 · EPSS 0%)
- CVE-2026-101127: Cross-site scripting (CVSS 9.4 · EPSS 0%)
- CVE-2026-102424: Path traversal (CVSS 7.5 · EPSS 0%)
- CVE-2026-101126: Path traversal (CVSS 6.5 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Balbooa Forms
Where it stands
- No known exploitation
Connects to
- Same weakness: Code injection (CWE-94). 239 other warnings in 30 days
- Same product: Earlier Balbooa Forms warnings. 1 in the last 90 days
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling `eval()`, the component replaces each shortcode with the raw value submitted by the visitor, leading to an RCE vector. A public form must use the product's optional PHP-after-submission action and interpolate an attacker-controlled field shortcode inside a double-quoted PHP string to be vulnerable.
Last activity 29 Sep 2026. Patch Forecast updates every hour.