CVE-2026-102424: Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4
Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose id merely looks numeric, the component trusts the supplied filename, concatenates it below the configured upload directory, and adds the result to an array of local attachment paths. It does not load the referenced attachment row, verify ownership/session/form/field, require that the ID exists, canonicalize the path, or enforce containment. If the form's normal “auto reply” and “attach uploaded files” options are enabled, the component sends those local paths as email attachments to the address submitted in an email field. A Guest can therefore submit a nonexistent numeric ID plus a traversal filename such as ../../../../configuration.php and receive any file readable by the Joomla process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Balbooa Formsto a version that resolves this vulnerability.Fixed in 2.4.3.4
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running Balbooa Forms earlier than 2.4.3.4 are exposed when a publicly accessible form has both the normal auto-reply option and the attach-uploaded-files option enabled. The vulnerable flow is reachable through public form submission without authentication.
What does an attacker need to exploit it?
An attacker needs access to a public form configured with an email field, auto-reply enabled, and uploaded files attached to the auto-reply. They can submit guest-controlled upload-field JSON containing a numeric-looking ID and a traversal filename pointing to a file readable by the Joomla process.
What data could be exposed?
Any local file readable by the Joomla process may be sent as an attachment to an email address supplied by the attacker. The described example targets configuration.php, but the affected file is determined by the process's filesystem permissions.
How can administrators determine whether they are affected?
Check whether the installed Balbooa Forms version is earlier than 2.4.3.4, then review publicly accessible forms for auto-reply and attach-uploaded-files settings. Forms with both options enabled and an email field meet the described exposure conditions.
What can be done if upgrading is not immediately possible?
Disable auto-reply or disable attaching uploaded files on public forms, as both are required for the described email exfiltration path. Restricting public access to affected forms also removes unauthenticated access to the vulnerable submission flow.