CVE-2026-102425: Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling eval(), the component replaces each shortcode with the raw value submitted by the visitor, leading to an RCE vector. A public form must use the product's optional PHP-after-submission action and interpolate an attacker-controlled field shortcode inside a double-quoted PHP string to be vulnerable.
Affected Software
Event History
Frequently Asked Questions
Which deployments are actually exposed?
Only public forms configured with the optional PHP-after-submission action are exposed, and the administrator-defined PHP must interpolate an attacker-controlled field shortcode inside a double-quoted PHP string. Installations without that configuration are not described as vulnerable by the available information.
Does an attacker need an account or administrative access?
No. The vulnerable path is triggered by a public form submission, so an unauthenticated visitor can exploit it when the affected form configuration is present.
What configuration should be checked during triage?
Review public Balbooa Forms for use of the PHP-after-submission action. Identify PHP code that includes form-field shortcodes within double-quoted strings, because submitted values are substituted raw before eval() is called.
What is the immediate mitigation if updating is not possible?
Disable the PHP-after-submission action on public forms, or remove attacker-controlled field shortcodes from double-quoted PHP strings in that action. This prevents the described raw-value substitution path from reaching eval().