{
  "crds_version": "0.1",
  "kind": "base",
  "id": "crds:cve-2026-56291",
  "revision": 1,
  "title": "Balbooa Forms for Joomla — unauthenticated file upload to RCE",
  "summary": "The Balbooa Forms extension for Joomla before 2.4.1 accepts uploads from anyone and does not restrict the file type, so an attacker can drop an executable script on the site and run it, taking over the whole web server.",
  "source_type": "cve",
  "severity": "critical",
  "cvss": {
    "score": 9.8,
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "version": "3.1"
  },
  "epss": 0.14854,
  "exploitation": {
    "known_exploited": true,
    "exploit_available": true,
    "attack_complexity": "low",
    "kev_added": "2026-07-10",
    "prerequisites": "Network access to a Joomla site running the extension; no account needed."
  },
  "remediation": {
    "patch_available": true,
    "fixed_in": [
      "Balbooa Forms 2.4.1"
    ]
  },
  "mitre_attack": [
    "T1190",
    "T1505.003"
  ],
  "kill_chain": "initial_access",
  "recommended_action": "Update Balbooa Forms to 2.4.1 or later now; then search the upload directories for unknown scripts and rebuild the site if any turn up.",
  "confidence": "high",
  "provenance": [
    {
      "fields": [
        "cvss",
        "exploitation.attack_complexity",
        "exploitation.exploit_available",
        "references",
        "published_at"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-56291",
      "retrieved_at": "2026-09-23T07:33:20.707Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "exploitation.known_exploited",
        "exploitation.kev_added"
      ],
      "source": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "retrieved_at": "2026-09-23T07:33:20.707Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "epss"
      ],
      "source": "https://api.first.org/data/v1/epss?cve=CVE-2026-56291",
      "retrieved_at": "2026-09-23T07:33:20.707Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "title",
        "summary",
        "severity",
        "remediation",
        "mitre_attack",
        "kill_chain",
        "recommended_action",
        "confidence",
        "tags",
        "exploitation.prerequisites"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-56291",
      "retrieved_at": "2026-09-23T07:33:20.707Z",
      "confidence": "high",
      "extractor": "claude-code"
    }
  ],
  "references": [
    {
      "type": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56291",
      "label": "NVD record"
    },
    {
      "type": "cisa",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "label": "CISA Known Exploited Vulnerabilities catalog"
    },
    {
      "type": "exploit",
      "url": "https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/"
    }
  ],
  "published_at": "2026-07-09T11:16:40.990Z",
  "issued_at": "2026-09-23T07:33:20.707Z",
  "tags": [
    "joomla",
    "balbooa",
    "file-upload",
    "webshell",
    "remote-code-execution",
    "kev"
  ]
}