CVE-2026-101126

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4

State: Published
Severity: 6.9 Medium
Published: Sep 29, 2026
Updated: Oct 1, 2026
Reserved: Sep 28, 2026

Description

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming, metadata tampering, and path traversal risks (e.g., via getFilePath())

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	Joomla

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-73 Destructive File Deletion and Potential System Compromise

Affected Products

Product	Versions
Balbooa Forms extension for Joomlabalbooa.com	1.0.0-2.4.3.3Affected

References

https://www.balbooa.com/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.