CVE-2026-56291: Unrestricted File Upload in Balbooa Forms for Joomla (KEV)
What's the vulnerability?
CVE-2026-56291 is an unrestricted upload of file with dangerous type flaw (CWE-434) in the Balbooa Forms extension for Joomla. The form builder's file upload feature fails to properly restrict the type and extension of uploaded files, allowing an attacker to submit files with dangerous extensions such as .php, .phtml, or .phar. Once uploaded to a web-accessible directory, these files can be invoked directly, giving the attacker remote code execution on the underlying web server.
Affected software
- Vendor: Balbooa
- Product: Forms (Joomla extension)
- No specific affected version range has been published at this time.
Exploitation status
This CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Defenders should treat this as an immediate priority: KEV listing means adversaries already have working exploitation techniques, and any internet-facing Joomla site running the vulnerable Balbooa Forms extension should be considered at risk of web shell deployment right now, not just theoretically vulnerable.
How our detection catches it
Our detection focuses on identifying the upload-then-execute pattern characteristic of this vulnerability class. At a high level, the logic watches for:
- HTTP requests to the Balbooa Forms upload endpoints carrying payloads with dangerous file extensions or MIME-type/extension mismatches indicative of extension-restriction bypass attempts.
- Subsequent web server access to newly uploaded files in forms/upload directories that execute as scripts rather than being served as static content.
- Follow-on indicators of web shell activity, such as anomalous process spawning from the web server process or outbound connections shortly after an upload event.
This logic is shipped across our full SIEM coverage set — Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL) — so teams can deploy the detection in whichever platform they already operate.
Get the full detection
For the complete detection logic, tuning notes, and platform-specific queries, see the full write-up at /detections/CVE-2026-56291.