CVE-2026-101126
Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming, metadata tampering, and path traversal risks (e.g., via getFilePath())
| CWE | CWE-22 CWE-73 |
| Vendor | balbooa.com |
| Product | balbooa forms extension for joomla |
| Published | Sep 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for balbooa.com balbooa forms extension for joomla
Be the first to know when new unknown vulnerabilities affecting balbooa.com balbooa forms extension for joomla are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
balbooa.com / Balbooa Forms extension for Joomla
1.0.0-2.4.3.3
Credits
Sergiy Tryzhychynskyi