If you received an email from me pointing you to this page, it is because your website appears to be running a version of Balbooa Forms (Balbooa’s com_baforms, which lives in your files at /components/com_baforms/ and /administrator/components/com_baforms/) that is affected by a known security issue. Balbooa Forms is a form-builder extension for the Joomla content management system. This page explains why that matters, how to read your version reliably, and how to fix it.

This notice concerns CVE-2026-56291, a critical (CVSS 10.0), actively exploited flaw that allows unauthenticated remote code execution through the extension’s front-end form attachment handling. It affects every release before 2.4.1. It was added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog on 10 July 2026.

The release that fixes this issue is not the release to update to, and this is the most important thing on the page. 2.4.1, published on 9 July 2026, does fix CVE-2026-56291. But a second, separate flaw in the same extension, CVE-2026-65880, affects releases through 2.4.2.1. An operator who updates to 2.4.1 or 2.4.2 therefore closes the door this notice is about and leaves another one open. A later release, 2.4.3.1, is a further security release hardening the same upload path. So: update to Balbooa Forms 2.4.3.1 or later, which is the current release at the time of writing. Do not stop at 2.4.1.

There is no older version that is safe. The protections that end this issue were added in 2.4.1, which means they were absent from every release before it. This is not a flaw that was introduced partway through the extension’s history: the vendor’s own changelog shows the front-end upload path running continuously back through the 2.0.x line and into 1.x, and I confirmed the unprotected handling directly in the 2.1.x, 2.2.0 and 2.3.x source. “My install is too old to be affected” is not a way out here, and in practice a great many of the affected installs I see are genuinely old ones.

Nothing has to be enabled for this to apply to you. The obvious assumption is that a site is only exposed if it publishes a form that accepts file attachments, so I want to be explicit that this is not the case. There is no setting that takes an affected version out of range, and the free edition of the extension ships the affected code just as the paid editions do, so “we only use the free version” is not a way out either. What matters is simply which version you are running.

Because this flaw was exploited before a fix existed, updating on its own is not the whole task. You should also check your site for signs that someone got there first (see If you were on an affected version below).

This is an extension flaw, not a Joomla core flaw. It affects sites on Joomla 4, 5, and 6 alike: a fully up-to-date Joomla core does not protect you if the Balbooa Forms extension itself is out of date.

Is this message legitimate?

Yes. This is a good-faith, responsible-disclosure notice from an independent security researcher. I am not asking you for money, passwords, or access to your site, and I have not attempted to break into it, upload anything, or exploit anything.

All I did was look at files that your website serves to every visitor (the same way your homepage is public): your pages, the extension’s own front-end asset addresses written into them, and the extension’s public manifest file. That is the whole of it. I specifically did not touch the affected upload feature, did not submit any form on your site, and did not request the images/baforms/uploads/ directory on your site or anywhere else. That path appears further down this page only as a place for you to look on your own site. Nothing about this check touches your data, your admin area, or any private part of your site.

If you would like to verify who I am, see the contact details at the bottom of this page and the About page.

Why this matters

Balbooa Forms builds contact forms, enquiry forms and similar forms on Joomla sites. Part of what it offers is the ability for a visitor to attach a file when submitting a form.

In affected versions, the handling behind that feature can be reached without logging in and does not properly check what kind of file it is being given. That combination lets an attacker place a program of their choosing on your server and run it: full remote code execution, with no account and no cooperation from you required.

This is not a theoretical risk. The flaw was scored 10.0 out of 10, the maximum, and it is being exploited in the wild. Exploitation was observed from 8 July 2026, a day before the fix was published on 9 July 2026, and the U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on 10 July 2026. It was reported by Phil Taylor of mySites.guru.

I am describing this at the level a site owner needs in order to act, and no further. I am not publishing the details that would let someone reproduce it, and I would ask you not to try it against your own site or anyone else’s. Reading your version number, as described below, tells you everything you need in order to decide what to do.

If my email cited this issue, it means the version your site reports is older than 2.4.1. I did not test whether your particular site is exploitable or already compromised, only that it reports an affected version.

How to check your version

You do not have to take my word for which version you are running. There are two trustworthy ways to check, and one misleading signal that is specific to this extension and worth knowing about.

From the Joomla administrator (authoritative):

  1. Log in to your Joomla administrator (usually at yourdomain.com/administrator).
  2. Go to System then Manage then Extensions (or Extensions then Manage, depending on your Joomla version).
  3. Search for Balbooa Forms and note the installed version.

From the manifest file on disk: open

/administrator/components/com_baforms/baforms.xml

and read its <version> element. That is what your site is actually running.

Mind which baforms.xml you read. A Joomla install with this extension contains three different files with that name, and only the one at the path above is the component’s own. The copies under /administrator/manifests/files/ and /plugins/editors-xtd/baforms/ carry their own version numbers, which are much older and do not track the component at all. Reading one of those by mistake will understate your version badly.

The version number in your page source is not reliable. Balbooa Forms stamps a version onto its front-end asset addresses, so if you view the source of a page carrying a form you may see something like ba-form.js?2.3.0.2. That number is not read from the files being served. It comes from Joomla’s database copy of the extension manifest, which only Joomla’s installer updates. If the extension was ever updated by copying files over the old ones rather than by installing through Joomla, the page can advertise a version the site is not running, and it can be wrong in either direction: an old number on updated files, or a new number on old ones. Use the administrator screen or the manifest file on disk instead.

Then apply this rule:

  • Anything older than 2.4.1: affected by this issue. There is no cut-off below which an older release becomes safe again.
  • 2.4.1 or 2.4.2: fixed as far as this issue is concerned, but still affected by CVE-2026-65880, the separate flaw mentioned above. Keep going.
  • 2.4.3.1 or later: current. This is where you want to be.

How to upgrade

The safest path is to update through Joomla itself, and to back up first:

  1. Back up your site (files and database) before making changes. Most hosting providers offer one-click backups, or use a Joomla backup extension.
  2. In the Joomla admin, open Extensions then Manage then Update, and click Find Updates. If a Balbooa Forms update is listed, install it from here.
  3. If no update appears there, get the latest release directly from the vendor, Balbooa, and install it via Extensions then Install. The free edition and the paid editions are both updated through the vendor’s own site.
  4. Install through Joomla, not by copying files over the old ones. Copying files leaves Joomla’s record of the version stale, which is what makes the page-source number unreliable in the first place, and it can leave old files behind.
  5. After upgrading, confirm the new version number (2.4.3.1 or later) using the steps above, and check that your forms still display and submit normally.

While you are in there, it is worth confirming that Joomla itself and your other extensions are up to date, since the same principle applies to all of them.

If you were on an affected version

Because this flaw was exploited before a fix was available, a site that ran an affected version should not assume that updating is enough. Updating closes the door, but it does not tell you whether anyone had already walked through it. That is worth checking calmly rather than assuming the worst: most sites will find nothing.

Here is what you (or your webmaster) can look for on your own site:

  • Unexpected PHP files in the uploads directory. Look for .php files anywhere under images/baforms/uploads/, including all of its subdirectories. Nothing legitimate puts PHP there. On a Linux host, the check is:

    find images/baforms/uploads -name '*.php' -type f
  • Administrator accounts you do not recognise. Review your user list in Users then Manage. Also check the registration dates on the accounts you do recognise, since an account created in early July 2026 that you assumed had always been there is worth a second look.
  • PHP files elsewhere on the site modified around or after early July 2026, particularly ones you cannot account for.

If you find any of these, treat the site as compromised: rotate all credentials (Joomla admin, database, FTP/SSH, hosting panel), review your Joomla user accounts and the groups they belong to, and consider restoring from a backup taken before 8 July 2026 rather than trying to clean the site in place. Cleaning in place is difficult to get right, because a backdoor left behind can undo the cleanup. If your organization has an IT security team or a national CERT, loop them in.

I want to be clear: I have not checked your site for any of these indicators, and I do not know whether your site was affected. This list is here so that you can check for yourself.

I do not have a webmaster / I am stuck

If you are not the person who maintains the site, please forward this page to whoever does (your web developer, agency, or hosting provider). They will recognize the steps above quickly.

If you are maintaining the site yourself and get stuck, I am happy to help point you in the right direction at no cost. Reach out using the contact details below.

Contact

Evan Harris, Security Researcher

I reach out about issues like this purely to help operators secure their sites. If you would prefer not to be contacted again, just let me know and I will honor that.

References

Official advisories and tracking

Vendor (Balbooa)

Reporting and analysis