Balbooa Forms (com_baforms) <= 2.4.2.1 - Unauthenticated Remote Code Execution (CVSS 10.0) and Arbitrary File Upload

Balbooa Forms up to and including 2.4.2.1 is affected by an unauthenticated remote code execution flaw (CVE-2026-65880, CVSS 4.0 base 10.0, AV:N/AC:L/PR:N/UI:N with high impact on confidentiality, integrity and availability across the security scope). Insecure form processing logic allows code execution on any form that includes the signature field type, with no login and no user interaction. Fixed in Balbooa Forms 2.4.3 - but 2.4.3 is no longer a safe ceiling, because CVE-2026-67364 (pre-auth PHP code injection, CVSS 10.0) and CVE-2026-67363 (pre-auth payment amount tampering, CVSS 7.7) affect 1.0.0 through 2.4.3.1 and were fixed in 2.4.3.2 on 18 August 2026, making 2.4.3.2 the current minimum safe version. This rule also covers two earlier flaws in the same component: CVE-2026-56291, an unauthenticated arbitrary file upload (RCE) in versions up to and including 2.4.0 - the frontend attachment upload accepted a file from any anonymous visitor with no login, no CSRF token and no allow-list on the file extension, and because it trusted the caller-supplied filename a .php upload was written to a public directory (by default images/baforms/uploads/) and could then be executed (CWE-434); and CVE-2025-49485, an SQL injection via the id parameter in 1.0.0 to 2.3.1.1, exploitable by privileged users. Update every Balbooa Forms install to 2.4.3.2 or later. Then check the upload folder for stray .php files and the Joomla user list for unfamiliar administrator accounts. Any site that was internet-facing on 2.4.2.1 or earlier with a signature-field form published should be treated as potentially compromised until it has been updated and checked. Also within this rule: CVE-2021-47930 (Balbooa Forms Builder 2.0.6 arbitrary file upload), which sits below this ceiling and needs no separate row.

Affected versions: ≤ 2.4.2.1

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions