Balbooa Forms upload flaw CVE-2026-56291 exploited to take over Joomla websites; fix available
Attackers used CVE-2026-56291 to take over Joomla websites running Balbooa Forms 2.4.0 or earlier. Version 2.4.1 fixed this flaw; update to the current 2.4.4.0 and have previously exposed sites checked for compromise.
If your family or business runs a Joomla website, ask its developer or hosting provider whether it uses Balbooa Forms and have it updated to 2.4.4.0. If it previously ran 2.4.0 or earlier, ask them to check for malicious files, unexpected administrator accounts and other signs of compromise, even if it has already been updated.
What’s happening
Balbooa Forms, an extension used to build forms on Joomla websites, allowed attackers without a login to upload executable files and run code on the website's server. mySites.guru discovered exploitation on 8 July while investigating a customer's hosting abuse report. Balbooa fixed CVE-2026-56291 in version 2.4.1 on 9 July, and CISA confirmed exploitation through its catalogue listing the following day. The flaw affects version 2.4.0 and earlier. Later releases address separate security problems, so owners should install the current 2.4.4.0. Updating does not establish that a previously exposed website is clean: it also needs checking for malicious files and unauthorised accounts. The reviewed sources do not establish the total number of compromised websites or that attacks have ended.
- What
- Flaw
- Affects
- Balbooa Forms extension for Joomla websites
- Affected
- Balbooa Forms 2.4.0 and earlier
- Fixed in
- Balbooa Forms 2.4.1
- Since
- 8 July 2026
- Closed
- 20 Oct 2026
Timeline
- Update
Balbooa released Forms 2.4.4.0, the latest version listed in its changelog as of 3 November.
- New fix
Balbooa released Forms 2.4.3.4 with further security fixes covering attachments, file paths and submission handling. These later fixes mean website owners should update beyond the original 2.4.1 release.
- Wider attacks
The Register reported researchers' warning that attackers continued targeting websites that had not installed the update.
- CISA added
CISA added CVE-2026-56291 to its Known Exploited Vulnerabilities catalogue, confirming its use in attacks.
- New fixFixed
Balbooa released Forms 2.4.1 to fix CVE-2026-56291, affecting 2.4.0 and earlier. The update added file-type checks, server-generated filenames and protection against forged upload requests.
- Made publicNo fix yet
mySites.guru investigated a customer's hosting abuse report and found attackers exploiting Balbooa Forms. Researcher Phil Taylor privately reported the flaw to Balbooa that day.
Sources
- Balbooa Joomla Forms changelogBalbooa · 20 Oct 2026
- Balbooa Forms Fixes an Unauthenticated File Upload RCEmySites.guru · 5 Oct 2026
- CVE-2026-56291: Joomla CNA and CISA recordsOpenCVE · 12 Aug 2026
- Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesThe Register · 14 July 2026