Balbooa Forms 2.4.3.4 Fixes Five Security Issues

Balbooa released Forms 2.4.3.4 on 29 September 2026 and asked every customer to install it as soon as possible. The release note lists five security fixes in the Joomla form builder (com_baforms), and the Joomla CNA published a CVE for each of them the same afternoon. All five are reachable by an anonymous visitor through a public form. The worst, scored CVSS 9.5, is remote code execution through the post-submission PHP action, the same feature behind a CVSS 10.0 CVE in August.

The CVE records put every Balbooa Forms release from 1.0.0 to 2.4.3.3 in range. If your sites run 2.4.3.3, as a large share of Balbooa Forms sites in the mySites.guru database still did on release day, they need this update. So does 2.4.3.2, the version everyone was told to install seven weeks ago.

TL;DR

Update every Balbooa Forms install to 2.4.3.4, then confirm the component reports 2.4.3.4. The flaws were reported by Sergiy Tryzhychynskyi and Łukasz Rybak, and David Jardin of the Joomla Security Strike Team coordinated the disclosure. The Joomla CNA scores the five CVEs from 6.9 to 9.5 and gives the affected range as every version below 2.4.3.4, which is what mySites.guru now flags.

What Balbooa Forms 2.4.3.4 fixes

Balbooa’s release note is a short table. The CVE records the Joomla CNA published later the same day describe each flaw in more detail, and everything below comes from those two sources. We have not diffed 2.4.3.3 against 2.4.3.4 ourselves.

Remote code execution through the PHP action

Balbooa Forms lets an administrator attach custom PHP to run after a form is submitted, and lets that PHP include field values through shortcodes. According to the CVE record, the component swaps each shortcode for the raw value the visitor typed and then passes the result to eval(). A form whose PHP puts a field shortcode inside a double-quoted string therefore runs whatever a visitor submits in that field.

In August, CVE-2026-67364 showed that a shortcode fed from a URL parameter could inject code into the same PHP, scored 10.0 and fixed in 2.4.3.2. This record is the same feature reached through ordinary form fields, and it puts 2.4.3.2 and 2.4.3.3 in range, so the August fix did not cover it. It only matters on forms where an administrator has set up a PHP action, which is a minority, but on those forms it is a complete takeover.

A path traversal into auto-reply emails

Balbooa Forms can send the person who filled in a form an automatic reply, and those emails can attach the files they uploaded. The CVE record confirms what the vendor’s “LFI protection” wording suggested. The final submission accepts the upload-field state as JSON from the visitor, trusts the filename in it, and joins it to the upload folder without checking the file exists, belongs to them or stays inside that folder. A visitor can submit ../../../../configuration.php as a filename and receive the site’s configuration file, database password included, at the address they typed into the form.

That only applies where a form has auto-reply switched on with uploaded files attached, so many sites are not exposed to it. You cannot tell which forms are set up that way without opening each one, and updating takes less time.

Other visitors’ attachments

Two fixes, CVE-2026-101112 and CVE-2026-101126, concern the files a visitor uploads while filling in a form. Before 2.4.3.4, removeTmpAttachment did not check that the attachment belonged to the person asking to delete it, so anyone could delete temporary or stored attachments from other people’s sessions. The final submission step had the same gap: the attachment references sent with a form were not tied to the session that uploaded them, so an attacker could point a submission at someone else’s file. The session token the form checks stops cross-site requests, but any guest can get a token for their own session, so it authorises nothing. Neither runs code. On a form that collects CVs, ID documents or signed paperwork, though, an attacker could delete or swap what a real applicant sent, and you would find out only when the file you needed was missing or wrong.

Stored XSS through a filename

In CVE-2026-101127, the upload endpoint checks a file’s extension and MIME type but stores the original filename exactly as sent. When an administrator opens the submission, the component’s JavaScript writes that name into the page through innerHTML. A filename is whatever the uploader says it is, so an anonymous visitor can plant script that runs when an administrator opens the submission. Script running in a Super User’s browser can do anything that Super User can, including installing extensions.

Which Balbooa Forms sites are affected?

All five CVE records give the same range: every release from 1.0.0 to 2.4.3.3. mySites.guru flags every Balbooa Forms version below 2.4.3.4 for these five CVEs. Releases below 2.4.3.2 are also flagged for earlier flaws, including CVE-2026-65880 and CVE-2026-67364, both unauthenticated remote code execution scored 10.0, so they are the most exposed. All of them need the same update.

Most sites that were two or three releases behind in August are now on 2.4.3.3, so their owners do update when told. The worry is the other end: one Balbooa Forms site in five is still on a version with a known unauthenticated remote code execution flaw, several releases after the fix and well after the July zero-day was being exploited.

What to do now

1. Update Balbooa Forms to 2.4.3.4 on every Joomla site that runs it, through Joomla’s update manager or the mySites.guru mass updater.
2. Check the version afterwards. Open System, Manage, Extensions and confirm the Balbooa Forms component, not only the package, reads 2.4.3.4.
3. Look at your forms’ auto-replies. If a form sends attachments in its auto-reply and a site stayed on an older version for a while, consider changing the database password in configuration.php and your hosting control panel, because that is the file a path traversal would go after.
4. Check for administrator accounts you did not create, since the stored XSS and the older flaws both lead to admin access.

Six Balbooa Forms security releases since July

This is the sixth security-related Balbooa Forms release in under three months:

There are two ways to read that list. The pessimistic reading is that a form builder that takes file uploads, runs PHP and handles payments from anonymous visitors has a lot of attack surface, and outside researchers keep finding more of it. The fairer one is that Balbooa ships fixes quickly, credits its reporters, emails its customers and coordinates with the Joomla Security Strike Team. For a site owner both lead to the same place: Balbooa Forms is an extension you keep on the current release all the time, not once a quarter.

Sergiy Tryzhychynskyi was also credited on the August hardening release, and Łukasz Rybak reported the Sourcerer PHP execution flaw in Regular Labs’ extension, so Balbooa Forms now has experienced researchers looking at it.

How do I find every Balbooa Forms site I manage?

The hard part of an extension release is rarely the update. It is knowing which of your sites run the extension and which version each one is on. Past a dozen sites, logging in to each Joomla admin to check is how an install gets missed, and a missed install is how one site in five ends up still exposed to a July flaw at the end of September.

mySites.guru keeps a live inventory of the extensions on each connected Joomla and WordPress site. Search for Balbooa Forms once and you get each site running it with its installed version. The 2.4.3.4 rule is already in our vulnerability database, so every connected site below 2.4.3.4 is flagged on your dashboard now, and the mass updater pushes the update to all of them from one screen.

The same subscription covers the checks that matter after a flaw like this: the audit looks for PHP files in upload folders, new administrator accounts and modified core files on every site, and flags them before a customer notices. It is all part of the subscription, with no add-ons.

If a Balbooa Forms site has already been hit, fix.mySites.guru cleans it, updates it and audits it for backdoors for a single fixed fee, usually the same day.

Severity and CVE status

The Joomla CNA published all five CVE records on 29 September 2026 with CVSS 4.0 scores, and mySites.guru uses them as published: Critical overall, from the 9.5 remote code execution flaw. The two most serious flaws have an attack requirement in their vector (AT:P), because each only works on a form set up a particular way, with a PHP action or with auto-replies that attach uploads. The other three need nothing but a public form with an upload field. The affected range, 1.0.0 to 2.4.3.3, is the one the rule flags.

Credit for the findings goes to Sergiy Tryzhychynskyi and Łukasz Rybak, and to David Jardin of the Joomla Security Strike Team for coordinating, per Balbooa’s release note. We did not find these issues.