CVE-2026-56291 is a critical-severity vulnerability, listed in the CISA KEV catalog. AttackerView checks Balbooa Forms sites for it with a live exploit check.
Detects Balbooa Forms for Joomla installations that let any anonymous visitor upload an executable file into the web root. Every build before 2.4.1 exposes the attachment uploader behind a form's file field as a front-end task with no login check and no form token check, so the upload runs for anyone who knows the address. The handler then takes the file extension straight from the name the visitor sent, cleans only the part in front of the dot, joins the untouched extension back on, and saves the result into the site's own public images folder, where the server runs .php. One request with no credentials therefore plants code, and the next request runs it, which is how the shells behind the CISA catalogue entry were planted. The verifier uploads a one-off file guarded by a token it generates for this scan, fetches it once, and treats the finding as proven only when the response contains a sum that nothing but a running interpreter could have produced. That same request makes the file delete itself, so the check leaves nothing on the server. CVSS 9.8, CISA KEV, exploited in the wild. Upgrade Balbooa Forms to 2.4.1 or later.
Is your app exploitable through CVE-2026-56291?
Scan your domain free