Path Traversal Vulnerability in Balbooa Forms by Joomla Extension

CVE-2026-102424

What is CVE-2026-102424?

The Balbooa Forms Joomla extension is susceptible to a path traversal vulnerability that allows unauthorized users to exfiltrate local files. When forms are submitted, the extension processes user-provided IDs and filenames without proper validation. This flaw permits attackers to craft requests that traverse the directory structure, potentially exposing sensitive configuration files. If the options for automatic replies and attaching files are enabled, the system can inadvertently send these sensitive files to the user’s email, thereby compromising the integrity of the website.

References