Balbooa Forms upload flaw on Joomla sites: are your controls ready?

TL;DR: A critical unauthenticated file upload flaw in Balbooa Forms, a Joomla form builder, lets anonymous attackers upload PHP and achieve remote code execution on exposed sites, according to CYCOGNITO. The case reinforces that public form endpoints and upload directories can become direct code-execution paths when extension governance, file handling, and web-root controls are weak.

Editorial analysis by NHI Mgmt Group, based on content published by CYCOGNITO: “Emerging Threat: (CVE-2026-56291) Balbooa Forms Remote Code Execution via Unauthenticated File Upload”.

By the numbers:

• CVE-2026-56291 carries a CVSS v3.1 base score of 9.8.
• The flaw also has a CVSS v4.0 base score of 10.0.

Practitioner guidance

• Inventory every internet-facing Joomla site Identify which public sites run Balbooa Forms or similar upload-enabled extensions, and confirm the exact installed version rather than assuming the core CMS is current.
• Disable script execution in upload directories Block .php and other executable content from running in directories such as images/baforms/uploads/ using server and WAF controls.
• Validate upload paths from the browser to disk Test whether anonymous uploads can write into web-served directories and whether the server will execute files placed there.

Bottom line: A public file upload feature can become a code-execution path when the application trusts filenames and stores uploads where the web server can run them.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →