File Metadata Tampering Risk in Balbooa Forms by Balbooa

CVE-2026-101126

What is CVE-2026-101126?

The vulnerability in Balbooa Forms allows attackers to exploit the final form submission process that handles JSON arrays per upload field. This process inadequately checks the client-supplied filenames and display names, which can lead to severe security risks such as cross-session claiming and metadata tampering. Additionally, the lack of stringent validation allows potential path traversal attacks, making it crucial for users of affected versions to apply necessary updates and patches promptly.

References