Attackers exploit Joomla extension vulnerabilities to execute remote code via malicious file uploads

Summary

CISA has added two high-severity vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. The flaws reside in the Balbooa Forms and iCagenda extensions for the Joomla CMS. Both vulnerabilities allow an unauthenticated attacker to upload arbitrary files, which can be executed as PHP code to gain total control over the host system.

Technical details

The vulnerability in Balbooa Forms (CVE-2026-56291) stems from a failure in how the extension handles frontend file attachments. The upload endpoint-reachable via index.php?option=com_baforms&task=form.uploadAttachmentFile-does not require a user to be logged in, nor does it validate requests with a CSRF token.

The flaw is exacerbated by a lack of file-type restrictions. While the extension uses Joomla's built-in filename cleaner, this process only sanitizes the name and does not block dangerous extensions like .php. An attacker can supply a filename such as shell.php, which the system then writes directly into a public directory (typically images/baforms/uploads/). Because this directory is served directly by the web server, requesting the uploaded file executes the malicious code immediately.

A similar mechanism exists in the iCagenda extension (CVE-2026-48939). The vulnerability allows for the upload of arbitrary files through its file attachment feature, leading to PHP code execution on the server.

Affected products and fixed versions

The following extensions are confirmed to be under active exploitation:

Exploitation status

Both vulnerabilities are currently being exploited in the wild. The Balbooa Forms flaw was identified as a zero-day after a hosting provider flagged suspicious activity via access logs. CISA has listed both vulnerabilities in its KEV catalog as of July 10, 2026, signifying that they are not merely theoretical threats but active targets for malicious actors.

Defender guidance

Immediate action is required for any administrator running these extensions on a Joomla installation.

Update and Audit

• Balbooa Forms: Update to version 2.4.1 or higher immediately. Do not wait for a scheduled maintenance window.
• Post-Patch Inspection: After updating, manually inspect your web directories-specifically images/baforms/uploads/-for any unexpected .php files or unauthorized administrative accounts. An attacker may have already established a foothold before you applied the patch.

Hardening Measures The fix implemented in Balboa Forms includes several layers of defense that should be mirrored in your own security practices:

• Extension Validation: Ensure file uploads are checked against an allow-list of specific, safe extensions (e.g., .jpg, .png).
• MIME Type Verification: Validate the actual content type of a file rather than relying on the extension provided by the user.
• Filename Randomization: Store uploaded files using randomly generated names to prevent attackers from predicting the URL needed to execute their payload.
• CSRF Protection: Ensure all sensitive endpoints, including file uploads, require a valid session token.