{"id":"balbooa-forms-upload-attacks-jul-2026","category":"patch","status":"closed","title":"Balbooa Forms upload flaw CVE-2026-56291 exploited to take over Joomla websites; fix available","tldr":"Attackers used CVE-2026-56291 to take over Joomla websites running Balbooa Forms 2.4.0 or earlier. Version 2.4.1 fixed this flaw; update to the current 2.4.4.0 and have previously exposed sites checked for compromise.","summary":"Balbooa Forms, an extension used to build forms on Joomla websites, allowed attackers without a login to upload executable files and run code on the website's server. mySites.guru discovered exploitation on 8 July while investigating a customer's hosting abuse report. Balbooa fixed CVE-2026-56291 in version 2.4.1 on 9 July, and CISA confirmed exploitation through its catalogue listing the following day. The flaw affects version 2.4.0 and earlier. Later releases address separate security problems, so owners should install the current 2.4.4.0. Updating does not establish that a previously exposed website is clean: it also needs checking for malicious files and unauthorised accounts. The reviewed sources do not establish the total number of compromised websites or that attacks have ended.","action":"If your family or business runs a Joomla website, ask its developer or hosting provider whether it uses Balbooa Forms and have it updated to 2.4.4.0. If it previously ran 2.4.0 or earlier, ask them to check for malicious files, unexpected administrator accounts and other signs of compromise, even if it has already been updated.","product":"Balbooa Forms extension for Joomla websites","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-56291"],"tags":["balbooa","joomla","forms","file-upload","remote-code-execution","actively-exploited"],"affected":["Balbooa Forms 2.4.0 and earlier"],"fixed":["Balbooa Forms 2.4.1"],"matches":[],"sources":[{"kind":"advisory","title":"Balbooa Joomla Forms changelog","url":"https://www.balbooa.com/help/joomla-forms-documentation/basics/changelog","by":"Balbooa","date":"2026-10-20"},{"kind":"research","title":"Balbooa Forms Fixes an Unauthenticated File Upload RCE","url":"https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/","by":"mySites.guru","date":"2026-10-05"},{"kind":"advisory","title":"CVE-2026-56291: Joomla CNA and CISA records","url":"https://app.opencve.io/cve/CVE-2026-56291","by":"OpenCVE","date":"2026-08-12"},{"kind":"news","title":"Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websites","url":"https://www.theregister.com/security/2026/07/14/baddies-caught-exploiting-extensions-bugs-with-perfect-10-scores-on-vulnerable-joomla-websites/5271001","by":"The Register","date":"2026-07-14"}],"started":"2026-07-08","closed":"2026-10-20","created":"2026-11-03T22:16:23.792Z","updated":"2026-11-03T22:16:23.792Z","cve_notes":[{"cve":"CVE-2026-56291","name":"Unauthenticated file upload in Balbooa Forms","what":"Missing checks in Balbooa Forms' public attachment upload handling let an attacker without a login upload executable files and run code on the Joomla website's server.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-10-20","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Balbooa released Forms 2.4.4.0, the latest version listed in its changelog as of 3 November.","url":"https://www.balbooa.com/help/joomla-forms-documentation/basics/changelog","by":"Balbooa","patch":null},{"at":"2026-09-29","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Balbooa released Forms 2.4.3.4 with further security fixes covering attachments, file paths and submission handling. These later fixes mean website owners should update beyond the original 2.4.1 release.","url":"https://www.balbooa.com/help/joomla-forms-documentation/basics/changelog","by":"Balbooa","patch":null},{"at":"2026-07-14","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"The Register reported researchers' warning that attackers continued targeting websites that had not installed the update.","url":"https://www.theregister.com/security/2026/07/14/baddies-caught-exploiting-extensions-bugs-with-perfect-10-scores-on-vulnerable-joomla-websites/5271001","by":"The Register","patch":null},{"at":"2026-07-10","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-56291 to its Known Exploited Vulnerabilities catalogue, confirming its use in attacks.","url":"https://app.opencve.io/cve/CVE-2026-56291","by":"OpenCVE, reproducing CISA's record","patch":null},{"at":"2026-07-09","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Balbooa released Forms 2.4.1 to fix CVE-2026-56291, affecting 2.4.0 and earlier. The update added file-type checks, server-generated filenames and protection against forged upload requests.","url":"https://www.balbooa.com/help/joomla-forms-documentation/basics/changelog","by":"Balbooa","patch":"patched"},{"at":"2026-07-08","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"mySites.guru investigated a customer's hosting abuse report and found attackers exploiting Balbooa Forms. Researcher Phil Taylor privately reported the flaw to Balbooa that day.","url":"https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/","by":"mySites.guru","patch":"none"}],"url":"https://hard.fyi/live/balbooa-forms-upload-attacks-jul-2026/","json":"https://hard.fyi/api/live?id=balbooa-forms-upload-attacks-jul-2026"}