{"id":"CVE-2026-56291","title":"The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.","summary":"The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-434"],"vendor":"balbooa","product":"forms","affected":["forms < 2.4.1"],"patched":["forms 2.4.1"],"published":"2026-07-09","updated":"2026-07-11","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56291","references":[{"url":"https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/","label":"security@joomla.org"},{"url":"https://www.balbooa.com/joomla-forms","label":"security@joomla.org"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56291","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","exploit-available"],"epss":0.14854,"epssPercentile":0.96539,"kev":true,"kevDateAdded":"2026-07-10","kevDueDate":"2026-07-13","kevRansomware":false,"exploited":true,"zeroDay":true,"ingestedAt":"2026-07-11T20:15:25.627Z","exploits":{"github":4,"githubRepos":["https://github.com/shinthink/CVE-2026-56291","https://github.com/0xdenis77/CVE-2026-56291","https://github.com/rimbadirgantara/CVE-2026-56291.yaml"],"nuclei":["CVE-2026-56291"],"checkedAt":"2026-09-23T07:14:24.769Z"},"exploitAvailable":true,"slug":"CVE-2026-56291","body":"## Overview\n\nThe Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.\n\n## Affected\n\n- `forms < 2.4.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `forms 2.4.1`","depth":"hadal","depthScore":82,"depthScoreParts":{"impact":53.9,"likelihood":3,"exploitation":25,"ransomware":0},"changes":[{"seq":5359,"id":"CVE-2026-56291","ts":1788887272141,"field":"exploit_available","old":"false","new":"true"},{"seq":4242,"id":"CVE-2026-56291","ts":1788886387058,"field":"exploit_available","old":"true","new":"false"},{"seq":2998,"id":"CVE-2026-56291","ts":1788883050434,"field":"exploit_available","old":"false","new":"true"},{"seq":2027,"id":"CVE-2026-56291","ts":1788882455041,"field":"exploit_available","old":"true","new":"false"},{"seq":1101,"id":"CVE-2026-56291","ts":1788881891961,"field":"exploit_available","old":"false","new":"true"},{"seq":180,"id":"CVE-2026-56291","ts":1787603664841,"field":"epss","old":"0.76066","new":"0.14595"},{"seq":95,"id":"CVE-2026-56291","ts":1784920495242,"field":"epss","old":"0.08635","new":"0.76066"},{"seq":68,"id":"CVE-2026-56291","ts":1784487999567,"field":"epss","old":"0.00836","new":"0.08635"}]}