CVE-2026-101126: Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4
Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming, metadata tampering, and path traversal risks (e.g., via getFilePath())
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Balbooa Forms versions earlier than 2.4.3.4 are identified as affected. The provided information does not state whether any particular Joomla or extension configuration changes exposure.
What does an attacker need to provide to exploit the issue?
The attacker needs to submit a form with upload-field JSON arrays containing numeric file IDs. Filenames and display names supplied by the client are trusted directly during final form submission processing.
What could indicate attempted exploitation?
Review form submissions for unexpected or manipulated upload filenames and display names associated with numeric file IDs. The described behavior may enable cross-session file claiming, metadata tampering, or path traversal through file-path handling.