CVE-2026-102424: Balbooa Forms Path Traversal Vulnerability

CVE-2026-102424 Overview

CVE-2026-102424 is an unauthenticated path traversal vulnerability in the Balbooa Forms Joomla extension prior to version 2.4.3.4. The component accepts guest-controlled JSON describing upload-field state during public form submission. When the auto reply and attach uploaded files options are enabled, the extension trusts an attacker-supplied filename, joins it beneath the upload directory, and attaches the resulting file to an outbound email. An unauthenticated attacker can submit a nonexistent numeric ID paired with a traversal filename such as ../../../../configuration.php and receive any file readable by the Joomla process.

Critical Impact
Unauthenticated attackers can exfiltrate arbitrary local files, including Joomla configuration.php containing database credentials and secret keys, via automated form auto-reply emails.

Affected Products

Balbooa Forms Joomla extension versions prior to 2.4.3.4
Joomla sites using Balbooa Forms with auto reply enabled
Joomla sites using Balbooa Forms with attach uploaded files enabled

Discovery Timeline

2026-09-29 - CVE-2026-102424 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102424

Vulnerability Analysis

The flaw is a classic path traversal weakness (CWE-22) in the file-attachment handling logic of Balbooa Forms. During a public form submission, the extension deserializes JSON that describes previously uploaded files. Each object contains an id field and a filename field. If the id merely appears numeric, the component treats the accompanying filename as trusted user input.

The extension concatenates that filename below the configured upload directory and appends the resulting path to a list of local attachments. It never queries the database to confirm the upload row exists. It never verifies session ownership, form association, or field membership. It never canonicalizes the resolved path, and it never checks that the final path remains within the upload directory.

When the form's auto reply and attach uploaded files settings are active, the extension sends those attachments to the email address supplied in the submission. This turns the form endpoint into a file-read oracle that returns files over SMTP.

Root Cause

The root cause is missing input validation and missing authorization on client-controlled attachment metadata. The component trusts guest input for both file identity and file path, and it performs no containment check against the upload base directory. Any file readable by the web server process becomes reachable through directory traversal sequences in the filename field.

Attack Vector

The attack requires only network access to a public Balbooa Forms endpoint. An attacker submits a form containing an email field they control and a crafted upload-state JSON payload. The payload includes a numeric-looking id for a nonexistent record and a filename value such as ../../../../configuration.php. The Joomla process reads the traversed file, attaches it to the auto-reply email, and delivers it to the attacker-controlled inbox. High-value targets include configuration.php, .env files, private keys, and log files containing session tokens.

Detection Methods for CVE-2026-102424

Indicators of Compromise

Outbound auto-reply emails from the Joomla mailer containing attachments with unexpected filenames such as configuration.php, .htaccess, or .env
Web server access logs showing POST submissions to Balbooa Forms endpoints from unauthenticated sessions with unusually large or nested JSON bodies
Mail queue entries where the attachment path resolves outside the configured Balbooa upload directory

Detection Strategies

Inspect form-submission request bodies for filename values containing ../, ..\\, URL-encoded traversal sequences (%2e%2e%2f), or absolute paths
Correlate high volumes of form submissions from a single source IP with subsequent outbound SMTP traffic containing attachments
Alert on Joomla mailer events where the attached file path does not begin with the sanctioned Balbooa upload prefix

Monitoring Recommendations

Enable verbose logging on the Joomla mailer to capture attachment paths for every outbound message
Forward web server and mail logs to a centralized analytics platform and query for traversal patterns against Balbooa endpoints
Monitor filesystem access by the PHP-FPM or Apache user for reads of sensitive files such as configuration.php outside expected code paths

How to Mitigate CVE-2026-102424

Immediate Actions Required

Upgrade Balbooa Forms to version 2.4.3.4 or later on every Joomla site where the extension is installed
Disable the auto reply option or the attach uploaded files option on all public forms until patching is complete
Rotate any secrets stored in configuration.php, including database credentials and the Joomla secret, if exposure is suspected

Patch Information

The vendor addressed the issue in Balbooa Forms 2.4.3.4. Refer to the Balbooa vendor site for the current release and release notes. Apply the update through the Joomla Extensions Manager and verify the installed version afterward.

Workarounds

Disable public access to affected forms until the update is installed
Restrict the Joomla process user's filesystem read permissions to the minimum required directories using operating system access controls
Deploy web application firewall rules that reject form submissions containing .. sequences or absolute paths in JSON filename fields

bash

# Example ModSecurity rule to block traversal in Balbooa form submissions
SecRule REQUEST_URI "@contains /index.php" \
  "chain,id:1029424,phase:2,deny,status:403,msg:'Balbooa Forms path traversal attempt (CVE-2026-102424)'"
  SecRule REQUEST_BODY "@rx (\"filename\"\s*:\s*\"[^\"]*(\.\./|\.\.\\\\|%2e%2e))" "t:lowercase"