Balbooa Gallery (com_bagallery) 1.0.0 to 2.4.0 - Authenticated Stored XSS

Balbooa Gallery versions 1.0.0 through 2.4.0 allow privileged users to store malicious scripts in gallery items. The injected payload is saved by the component and executed in the browser of any user who later views the affected gallery, so a lower-privileged content author can escalate against an administrator. Fixed in 2.4.1 (released 5 June 2025), whose changelog records a "Cross-Site Scripting (XSS) web security vulnerability" fix. Update to 2.4.1 or later; 2.5.0 adds Joomla 6 compatibility. Note this is the Gallery component - the separate Balbooa Forms flaw is covered by its own rule. Also folded into this rule: CVE-2023-23757 (CVSS 3.1 9.8 CRITICAL), an unauthenticated SQL injection the Joomla CNA records against "BA Gallery" 1.0.0-1.2.0, attributed to bestaddon.com rather than Balbooa. That range sits entirely inside this rule's 1.0.0 to 2.4.0 window and prod carries com_bagallery installs at 1.2, so any affected install is already flagged either way. Recorded here so the CVE does not resurface as new on the next NVD sync.

Affected versions: ≥ 1.0.0 and ≤ 2.4.0

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions