Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.5

Balbooa Forms lets attackers run code on server

CVE-2026-102425 · published 19 days ago
Summary

The Balbooa Forms extension for Joomla can run custom PHP code after a public form is submitted. Because it inserts the visitor's input into that code before it runs, a stranger can supply malicious input and cause the server to execute any commands. Upgrade to version 2.4.3.4 or later, or disable the post‑submission PHP feature, to prevent this risk.

What to do
  • Update balbooa forms to version 2.4.3.4 or later.
Affected software
VendorProductAffected versions
balbooa.com balbooa forms extension for joomla 1.0.0-2.4.3.3
balbooa forms < 2.4.3.4
cpe:2.3:a:balbooa:forms:*:*:*:*:*:joomla\!:*:*
Original advisory text
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling `eval()`, the component replaces each shortcode with the raw value submitted by the visitor, leading to an RCE vector. A public form must use the product's optional PHP-after-submission action and interpolate an attacker-controlled field shortcode inside a double-quoted PHP string to be vulnerable.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.5 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published29 Sep 2026
Updated19 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-102425 · NVD
CVE-2026-102425 · MITRE
Track software like this
Free during beta