CVE-2026-67364: Joomla Balbooa Forms RCE Vulnerability

CVE-2026-67364 Overview

CVE-2026-67364 is a pre-authentication PHP code injection vulnerability in the Balbooa Forms extension for Joomla, affecting versions prior to 2.4.3.2. The flaw resides in the form's optional custom-PHP post-submission handler, which is executed through eval(). The [URL parameter = X] shortcode substitutes the raw, unescaped value of a query parameter directly into the evaluated PHP context. This lets an unauthenticated attacker inject arbitrary PHP that executes server-side. The Cross-Site Request Forgery (CSRF) token protecting the submission endpoint is disclosed anonymously via a separate task, offering no meaningful barrier.

Critical Impact
Unauthenticated remote attackers can execute arbitrary PHP on the underlying web server, leading to full site compromise, database theft, and lateral movement within hosting environments.

Affected Products

Balbooa Forms Joomla extension versions prior to 2.4.3.2
Joomla sites with a form configured to use the custom-PHP post-submission handler
Forms referencing the [URL parameter = X] shortcode without reCAPTCHA on the submit button

Discovery Timeline

2026-08-19 - CVE-2026-67364 published to the National Vulnerability Database (NVD)
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-67364

Vulnerability Analysis

Balbooa Forms allows site builders to attach a custom-PHP handler that runs after a form submission. The handler script is passed to PHP's eval() function, evaluating any code contained within it. Within that script, authors can reference request data using the [URL parameter = X] shortcode, which the extension resolves before evaluation. The resolver copies the raw query-string value into the PHP text without escaping or type-casting. An attacker who controls the referenced query parameter therefore controls the PHP source being evaluated. Because the endpoint is reachable without authentication and the CSRF token is anonymously disclosed by another task, no valid session or user interaction is required.

Root Cause

The root cause is unsafe use of eval() combined with unsanitized input substitution, categorized as improper control of code generation [CWE-94]. The shortcode expansion treats attacker-controlled query values as trusted code fragments rather than opaque data.

Attack Vector

Exploitation requires a targeted form that (1) has the custom-PHP handler enabled, (2) references the [URL parameter = X] shortcode, and (3) lacks reCAPTCHA on the submit button. An attacker first retrieves the anonymously exposed CSRF token, then submits a crafted POST request with a query parameter whose value closes any surrounding PHP context and appends attacker-controlled statements. When the extension evaluates the handler, the injected PHP runs under the web server user, yielding remote code execution over the network.

The vulnerability mechanism relies entirely on standard Joomla request handling. See the Balbooa Security Overview for vendor references.

Detection Methods for CVE-2026-67364

Indicators of Compromise

Unexpected outbound connections initiated by the Joomla PHP process shortly after POST requests to Balbooa Forms submission endpoints.
New or modified PHP files under the Joomla images/, tmp/, or extension directories owned by the web server user.
Access log entries containing long, URL-encoded PHP fragments in query parameters targeting Balbooa Forms task URLs.
Anonymous requests retrieving the CSRF token task immediately followed by form submissions from the same source IP.

Detection Strategies

Alert on eval()-triggered process spawns such as sh, bash, python, or curl originating from the PHP-FPM or Apache worker process.
Inspect web server access logs for query parameters containing PHP tokens like ;, system(, passthru(, base64_decode(, or backticks against Balbooa Forms endpoints.
Baseline expected form submission payload sizes and flag outliers directed at option=com_baforms or similar Balbooa routes.

Monitoring Recommendations

Enable file integrity monitoring on Joomla web roots to detect webshell placement.
Forward Joomla and web server logs to a centralized analytics platform for correlation of token-retrieval and submission events.
Monitor egress from web server hosts to detect reverse shells or data staging following exploitation.

How to Mitigate CVE-2026-67364

Immediate Actions Required

Upgrade Balbooa Forms to version 2.4.3.2 or later on every Joomla site using the extension.
Audit each form for a configured custom-PHP handler and remove handlers that reference the [URL parameter = X] shortcode.
Enable reCAPTCHA on all public-facing Balbooa forms to raise the bar for automated exploitation attempts.
Review web server, Joomla, and database logs for signs of prior exploitation and rotate any credentials stored on the host.

Patch Information

Balbooa addressed the flaw in Balbooa Forms 2.4.3.2. Administrators should apply the update through the Joomla Extensions Manager and verify the installed version afterward. Refer to the Balbooa Security Overview for release information.

Workarounds

Disable any Balbooa form that uses a custom-PHP post-submission handler until the patch is applied.
Remove references to the [URL parameter = X] shortcode from custom-PHP handlers and hard-code trusted values instead.
Restrict access to Balbooa Forms endpoints at the web application firewall (WAF) layer, blocking requests with PHP metacharacters in query parameters.

bash

# WAF example: block PHP metacharacters on Balbooa Forms endpoints
# ModSecurity rule (illustrative)
SecRule REQUEST_URI "@contains option=com_baforms" \
  "phase:2,deny,status:403,id:1026673640,\
   chain,msg:'Possible CVE-2026-67364 exploit attempt'"
  SecRule ARGS "@rx (?i)(system\(|passthru\(|base64_decode\(|`|<\?php|eval\()" \
    "t:urlDecodeUni"