CVE-2026-101126: Balbooa Forms

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming, metadata tampering, and path traversal risks (e.g., via getFilePath())

Affected products

• Balbooa Forms: before 2.4.3.4 (fixed in 2.4.3.4)

Published 2026-09-29. Last modified 2026-10-06.