Balbooa vulnerabilities

CVE-2026-102425 Critical · 10.0 CWE-94 Sep 29, 2026

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling `eval()`, the component replaces each shortcode with the raw value submitted by the visitor, leading to an RCE vector. A public form must use the product's optional PHP-after-submission action and interpolate an attacker-controlled field shortcode inside a double-quoted PHP string to be vulnerable.

CVE-2026-102424 High · 7.5 CWE-22 Sep 29, 2026

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose `id` merely looks numeric, the component trusts the supplied `filename`, concatenates it below the configured upload directory, and adds the result to an array of local attachment paths. It does not load the referenced attachment row, verify ownership/session/form/field, require that the ID exists, canonicalize the path, or enforce containment. If the form's normal “auto reply” and “attach uploaded files” options are enabled, the component sends those local paths as email attachments to the address submitted in an email field. A Guest can therefore submit a nonexistent numeric ID plus a traversal filename such as `../../../../configuration.php` and receive any file readable by the Joomla process.

CVE-2026-101127 Critical · 9.4 CWE-79 Sep 29, 2026

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in `#__baforms_submissions_attachments.name`. A later anonymous form submission associates that temporary attachment with the newly created submission. When an administrator opens the submission, the component's JavaScript retrieves the stored attachment record and concatenates `file.name` directly into an HTML string. The complete string is assigned to `innerHTML`.

CVE-2026-101126 Medium · 6.5 CWE-22 Sep 29, 2026

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming, metadata tampering, and path traversal risks (e.g., via getFilePath())

CVE-2026-101112 Medium · 5.3 CWE-639 Sep 29, 2026

Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file. The controller verifies a Joomla session token, but the model does not bind that ID to the session that uploaded the file, the current user, the form, the upload field, or the temporary state. Any guest can obtain a token for their own session, so the token prevents CSRF but does not authorize the target object.

CVE-2026-65947 High · 7.3 CWE-352 Jul 29, 2026

Cross-Site Request Forgery (CSRF) in Balbooa Gridbox

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2

CVE-2026-65888 Critical · 9.8 CWE-284 Jul 29, 2026

Improper Access Control in Balbooa Gridbox

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.

CVE-2026-65887 Critical · 9.8 CWE-284 Jul 29, 2026

Improper Access Control in Balbooa Gridbox

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins.

CVE-2026-65886 High · 7.5 CWE-22 Jul 29, 2026

Path Traversal in Balbooa Gridbox

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.

CVE-2026-66490 Medium · 6.1 CWE-79 Jul 29, 2026

Cross-site Scripting (XSS) in Balbooa Gridbox

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2

CVE-2026-66489 Medium · 5.3 CWE-200 Jul 29, 2026

Exposure of Sensitive Information in Balbooa Gridbox

Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2

CVE-2026-66488 Medium · 5.3 CWE-285 Jul 29, 2026

Improper Authorization in Balbooa Gridbox

Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2

CVE-2026-65890 Critical · 9.8 CWE-89 Jul 29, 2026

SQL Injection in Balbooa Gridbox

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.

CVE-2026-65889 High · 7.5 CWE-22 Jul 29, 2026

Path Traversal in Balbooa Gridbox

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories.

CVE-2026-65885 High · 8.8 CWE-434 Jul 29, 2026

Unrestricted Upload of File with Dangerous Type in Balbooa Gridbox

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.

CVE-2026-65884 Critical · 9.8 CWE-284 Jul 29, 2026

Improper Access Control in Balbooa Gridbox

Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions.

CVE-2026-56291 Critical · 9.8 KEV Urgent · 72 Public exploit CWE-434 Jul 9, 2026

Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

CVE-2021-47930 High · 8.2 CWE-89 May 10, 2026

Balbooa Joomla Forms Builder 2.0.6 SQL Injection Unauthenticated

Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handler that allows remote attackers to execute arbitrary SQL queries. Attackers can send POST requests to the com_baforms component with malicious JSON payloads in the 'id' field parameter to extract sensitive database information.